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The Health and Safety Executive hopes that publication of this paper will stimulate consideration 
and discussion of the issues raised. 


Any responses to the document would be welcome and should be sent to: 


Dr Jean Le Guen 
Health and Safety Executive 
Risk Assessment Policy Unit 
Room 716, Rose Court 
2 Southwark Bridge 
London SE1 9HS 
Tel: 0171-717 6403 
Fax: 0171-717 6955 
e-mail: jean.le.guen@hse.gov.uk 


to reach him not later than 15 December 1999 


The Health and Safety Executive tries to make its consultation procedure as thorough and open as possible. 
Responses to this discussion document will be lodged in the Health and Safety Executive’s Information Centres 
after the closing date of the period for comment where they can be inspected by members of the public or be 
copied to them on payment of the appropriate fee to cover costs. 


Responses to this discussion document are invited on the basis that anyone submitting them agrees to them being 
held in this way. Responses, or part of them, will be withheld from the Information Centres only at the express request 
of the person making them. In such cases a note will be put in the index to the responses identifying those who have 
responded and have asked for their views, or part of them, to be treated as confidential. 
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PREFACE 


The need for public explanation of the basis for decisions about the regulation of risks now 
arises in wide areas of public policy-making. In former times, the issue hardly ever featured, at 
least outside the circle of technical specialists. Activities were, by implication or assertion, 
either safe or they were not. Indeed, that belief still features largely in the public imagination. 
Yet the conduct of human affairs does not divide into such black and white terms. The very 
word 'risk' itself denies it, implying that there are degrees of safety. And we all realise 
intuitively that the safety we seek must in some way be balanced against the benefits we forgo. 
We have our own individual needs as we perceive them for peace of mind and bedy. Society 
may wish in addition to ensure the regulation of risks that offend against society's collective 
sense of equity and fairness. Such offence is manifested for example in the public reaction to 
multiple fatality accidents or wide-ranging impacts on health. 

For long, the priority of society was for the basic wants of life. Government legislated to avoid 
the excesses of harm from industrial activity, making its own judgements about which risks 
prevailing social attitudes would not tolerate. Greater prosperity and improved standards of 
living are now accompanied, perhaps not surprisingly, by greater public demand for healthier 
workplaces, a cleaner environment, better housing, safer food and commercial products. The 
end result is an apparent aspiration for a society free of involuntary risks, underpinned by a 
belief that the state has a duty to insulate people from harm. There is in consequence an 
increasing demand for explanation of how it is intended to protect against harm, both in general 
and in particular circumstances. Furthermore, there is an expectation that this explanation 
should be transparent and comprehensible so that the public can play its part, if it chooses to do 


so, in influencing the decisions. 


This social pressure for explanation of and involvement in the basis of decisions about health 
and safety was a central influence on the Robens Committee of 1972. Their recommendations 
responded to that pressure, particularly those relating to representation of the different interests 
at the highest level of decision-making, to consultation with stakeholders and to the engagement 
of safety representatives and safety committees at the level of the workplace. But a very direct 


impetus for explanation was provided by the 1986 report of the Public Inquiry into the 


lil 


Sizewell B Nuclear Power Stations The Inquiry Inspector, Sir Frank Layfield, asked that HSE 
should ‘formulate and publish guidelines on the tolerable levels of individual and societal risk to 
workers and the public from nuclear stations.' As a result, HSE published in 1988 the document 
'The Tolerability of Risk from Nuclear Power Stations.' The document set out a framework, 
which has since become known as the Tolerability of Risk or TOR framework, which describes 
HSE's philosophy of risk control for nuclear power stations. The philosophy specifically 
addressed in that context the rel to advance from the division that things were either safe or 
not safe. The document was reissued in 1992 following public consultation, and the underlying 
philosophy has since gained considerable acceptance by other regulators and industry as having 
wider applicability beyond nuclear power. In particular, the argument is now widely accepted 
that a properly informed balancing act between risks and benefits is of central importance to 
decisions on the levels of risk that are tolerable. The word ‘tolerable’ acquired a particular 
meaning, in effect opening up a gap between absolutely safe and unsafe, with tolerable risks 


(‘safe enough’) occupying the range in between. 


The balancing act has long been recognised in the law relating to health and safety at work. 
Indeed, the balancing act is applied at a fundamental level in that the law imposes a general duty 
that health and safety should be secured at all times, subject only to the qualification that 
measures should be adopted 'so far as is reasonably practicable.’ Hence the general duties focus 
on health and safety, with no discrimination by level of hazard or risk. There is thus a 
requirement on the regulator to ensure that the health and safety of an activity is considered in a 
wide context. In many instances, the risks from an activity can be controlled by suitable 
measures to reduce the chance of harm to sufficiently low levels or, in other words, to reduce 
the risks 'as low as reasonably practicable’ so that desirable activity can be undertaken in the 
absence of absolute assurance of safety which would be incompatible with continuation of the 
activity. In other instances, the activity may be so inherently and transparently unsafe that it 
cannot be allowed irrespective of whatever risk might be estimated. And yet other activities 
may not be admissible because, though sharing of the exposure to harm between many different 
individual may result in a low chance of harm to any one individual, other factors such as 
societal concerns are present which result in society regarding the activities as unacceptable and 


so not to be entertained. What the TOR document did was to expose to scrutiny the way that 


the balancing act is applied by the regulator in the particular area of nuclear power generation. 
It relied on quantitative methods and this fitted naturally into a scheme pertaining to risks from 
nuclear power generation and similar activities where there is considerable available data on the 
nature of the hazards present and the risks that they entail. For some other areas, the approach 
adopted for nuclear power is directly applicable. But there is a wide range of harms where 
there is not enough data to use the quantitative methods used in TOR but where further 
explanation, adaptation and extension of the same basic philosophy is needed. This document 
seeks to fulfil that purpose by explaining tolerability in terms appropriate to the particular 


characteristics of the harm from which it is intended to protect people. 


The description that follows is holistic and embraces the full spectrum of harms controlled by 
health and safety regulation. As with the earlier TOR document, the present one is being issued 
as a discussion document. It is aimed primarily at interested participants in the occupational 
health and safety arena. It focuses on the approach of the regulator (HSE) to the structuring of 
advice on policy to the Health and Safety Commission (HSC) and to the subsequent 
implementation of policy when decided by HSC following public consultation and 
Parliamentary/Ministerial approval. The document sets out the basis and criteria for decisions 
on control measures, the way scientific evidence (or the lack of it) and uncertainties are taken 
into account and how the balance is struck between the benefits of adopting a measure to avoid 
or control the risks against its disadvantages. The HSC fully supports the publication of this 


document for discussion. 


Advice to the Commission and the regulatory approach operate against the background that the 
Act is intended to maintain or improve standards of health and safety. Progress in good 
practice and technology means that we are able to use the SFAIRP principle to improve 
progressively health and safety standards - to 'go the extra mile for safety' as Stan Robertson, 
Chief Inspector of Railways, said in his 1997 Annual Report. In view of its broad applicability, 
the exposition will also appeal to anyone interested in the regulation of risk in general. So far as 
possible the text is kept clear of technical detail; such detail as is necessary is given in annexes 


or obtainable in cited references. 


Throughout our history of consulting and negotiating with stakeholders we have been very 
conscious that we do not have a monopoly of wisdom on health and safety matters. We rely 


heavily on comments received to get things right and we look forward to receiving your views. 


hewn 


Jenny Bacon 
Director General 
Health and Safety Executive. 


FOREWORD 


We are very conscious that our decisions can have widespread reverberations through society 
and that to gain the trust of the public and acceptance of our decisions, what we do must reflect 
society's values at large. We believe that this can only happen if we are open - as we try to be 
throughout this discussion document - about what HSE does (or should do) in undertaking its 


regulatory functions for ensuring consistency and coherence in its approach. 


The compilation of this explanatory document has therefore necessarily been an internal matter. 
It was prepared under the auspices of an HSE internal working group representative of all the 
policy and operations functions of HSE. The drafting of the document has largely been 
undertaken by Dr Jean Le Guen, Head of HSE's Risk Assessment Policy Unit. 


This document builds on a previously published document’ (known as the TOR document) 
which set out HSE's philosophy for deciding the degree to which risks should be controlled in 
the nuclear power generation industry. The TOR document was first published in 1988 and 
revised in 1992. It provides a framework, now well established in the regulation of the nuclear 
industry, that helps to decide which risks are unacceptable, tolerable or broadly acceptable. But 
it is also being increasingly used in other sectors to decide on the degree to which risk should be 


controlled - a move prompted by a number of relatively recent legislative changes. 


The quantitative methods described in the TOR document were particularly appropriate for the 
nuclear industry by providing a useful input to the informed dialogue between the regulator and 
the regulated that is central to the self-regulatory approach. However, it is often not 
appreciated that the TOR philosophy in its essentials - namely that risks can be classified as 
unacceptable, tolerable or broadly acceptable - is applicable across the full range of risks 
whether they are quantifiable or not. This discussion document is meant to fill this gap by 


setting out a generalised application of the philosophy. 
We would welcome views on the principles, processes, protocols and criteria described in this 
discussion document, and would like to hear in particular: 

i) of examples which would seem to show that the framework for reaching decisions 


does not apply and, if so, what changes would be necessary for universal applicability; 


ii) of areas where the framework does apply but the criteria adopted on the tolerability of 
risk would cause difficulties and, if so, the nature of these difficulties and how they 


can be addressed; 


"Health and Safety Executive, "The Tolerability of Risk from Nuclear Power Stations", 1988, 
(revised 1992), HMSO, London; ISBN 011 886368 1. 


Vil 


iii) whether the use of good practice has been given the right emphasis in the decision 
making process; 


iv) whether the principles for assessing risk reduction options and conducting cost benefit 
analysis described at Annex 3 achieve the right balance between costs and risks. If 
not, how could the principles be amended? 


v) we would also like to have your views how (in the following order: very well, well, 


not well, poorly) you would rate this document in explaining the issues it addresses; 


vi) if you answered ‘not well’ or ‘poorly’ in (v) above, we would like to hear your 


suggestions how things might be improved for the future. 


Please send your comments to Dr Jean Le Guen at the address on the front cover. 


nel ges Wr Our y 


Dr J McQuaid 

Chief Scientist, and 

Director, Science and Technology Directorate, 
Health and Safety Executive. 
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ACoP 
ACTS 
ALARA 
ALARP 
CBA 

CD 

CEN 
CENELEC 
CLAW 
COSHH 
EC 

HSC 
HSE 
HSW 
ICRP 
IEC 

ISO 
MEL 
MHSWR 
NOAEL 
OEL 
OES 
QRA 
SFAIRP 
TOR 
WATCH 


GLOSSARY OF ACRONYMS 


Approved Code of Practice 

Advisory Committee on Toxic Substances 

As Low as is Reasonably Achievable 

As Low as is Reasonably Practicable 

Cost Benefit Analysis 

Consultative Document 

Comité Européen de Normalisation 

Comité Européen de Normalisation Electrotechnique 
Control of Lead at Work Regulations 

Control of Substances Hazardous to Health Regulations 
European Commission 

Health and Safety Commission 

Health and Safety Executive 

Health and Safety at Work 

International Commission on Radiological Protection 
International Electrotechnical Commission 
International Organisation for Standardisation 
Maximum Exposure Limit 

Management of Health and Safety at Work Regulations 
No Observed Adverse Effect Level 

Occupational Exposure Limit 

Occupational Exposure Standard 

Quantitative Risk Assessment 

So Far as is Reasonably Practicable 

Tolerability of Risk 


Working Group on the Assessment of Toxic Chemicals 
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EXECUTIVE SUMMARY 


This document describes the decision-making process that we adopt and the factors that 


influence our decisions on what risks are unacceptable, tolerable or negligible and test the 


soundness of our approach. 


It is in three parts and has four annexes as follows: 


Part1: i) 


i) 


1 


— 


Sets out the aims of the document, namely the need to: 


open to scrutiny HSE's approach to the management and regulation of risk and 
the philosophy underpinning it; 

make transparent the factors that inform our decisions on risks, for example how 
account is taken of the scientific knowledge of the risks concerned, the 
technology available for controlling them, public attitudes towards the risks and 
the benefits they engender and show how these shape the form and content that 
our regulations and guidance take; 

help reassure the public that industry, in taking advantage of technological 
advances, will not be allowed to impose unnecessary risks on people; 

let other regulators, whose responsibilities may overlap with those of HSC/E, 
know the basis for the management of occupational health and safety risks and 


thereby help to promote consistency of decision-making amongst regulators. 


Mentions some of the difficulties inherent in meeting the above aims, particularly 


those involved in taking account of ethical, social, economic and _ scientific 


considerations and the preference values of society at large. 


iii) Introduces the concept of tolerability which is central to the document. This 


concept refers to a willingness to live with a risk so as to secure certain benefits in the 


confidence that the risk is one that is worth taking and that it is being properly 


controlled. As such, a ‘tolerable’ risk is not therefore necessarily one that will be 


judged to be ‘acceptable’ by those taking it. 


iv) Points out that the proper regulation of risks requires that both the individual risks 


and societal concerns engendered by a hazard must be addressed. 


Part 2: i) 


Reviews some of the developments that have influenced our approach to decision- 
making since the recommendations of Robens were incorporated in the HSW Act. 
The developments examined include advances in knowledge on how people view 
risks; changes in the regulatory environment and on the industrial scene; and shifts 


in the values, preferences and expectations of our society. 


ii) Describes the principles of good regulation that have evolved in adapting our 


iii) 


approach to take account of the developments; namely: 


the targeting of action: focusing on the most serious risks or where the hazards are 


less well controlled; 


consistency: adopting a similar approach in similar circumstances to achieve similar 


ends; 

proportionality: requiring action that is commensurate to the risks; 

transparency: being open on how decisions are arrived at and what are their 
implications; and 

accountability: making clear for all to see who are accountable when things go 


wrong, but without resorting to unfair retribution. 


Notes some of the above developments which have been particularly important, in 


particular: 

the need for the meaning of ‘risk’ to encompass more than physical harm by taking 
into account other factors such ethical and social considerations; 

the ruling by the Courts on the meaning of ‘hazard’ which implies that approaches 
for managing risks must ensure that hazards present are properly addressed. 
Describes the six stage iterative system adopted for reaching decisions, namely: 
deciding whether the issue is primarily one for HSC/E; 

defining and characterising the issue; 

examining the options available for addressing the issue, and their merits; 


adopting a particular course of action for addressing the issue, informed by the 


knowledge gained going through the six stage iterative system and by the 


expectation that as far as possible the course of action will be supported by 


stakeholders; 
implementing the decisions; 


evaluating the effectiveness of actions taken and revising the decisions and their 


implementation if necessary. 


Sets out the framework, known as the Tolerability of Risk (TOR), for reaching 
decisions on whether risks from an activity or process are unacceptable, tolerable or 
broadly acceptable and their application in practice. In this context, tolerable does 
not mean acceptable. It refers instead to a willingness to live with a risk so as to 
secure certain benefits and in the confidence that the risk is one that is worth taking 


and that it is being properly controlled. The framework makes clear that: 


both the level of individual risks and the societal concerns engendered by the 
activity or process must be taken into account when deciding whether a risk is 


unacceptable, tolerable or broadly acceptable; 


the decision-making process and criteria adopted are such that action taken is 


inherently precautionary; 


HSE starts with the expectation that suitable controls must be in place to 
address all significant hazards and that those controls, at a minimum, must 
implement authoritative good practice precautions irrespective of situation-based 


risk estimates; 


where there is no reliable base of good practice for ensuring that risks are 
adequately controlled, it will be necessary to go through a risk assessment and 


evaluation process for deciding the degree to which the risks should be controlled; 


that there are some risks from certain activities, processes or practice which are not 
tolerable whatever the benefits, ie they are unacceptable. Any activity, process or 
practice giving rise to risks falling in that region would be ruled out unless the 
activity, process etc can be modified to reduce the degree of risk to such a degree 


that it becomes tolerable; 
as control measures are introduced, the residual risks may fall so low that additional 
measures to reduce them further are likely to be grossly disproportionate to the risk 


reduction achieved; 


Annex IL: 


Annex 2: 


Annex 3: 


Annex 4: 


HSE has proposed numerical criteria for informing decisions on the tolerability of 
risks only for a very limited category of risk, namely those entailing fatalities either 


individually or in multiple fatality accidents. 


Sets out some of the conventions adopted for undertaking risk assessment. It points 


out: 


that more often than not a risk assessment is done in relation to a hypothetical 
person (a hypothetical type of individual who is deliberately assumed to have some 


fixed relation to the hazard under consideration); 


the procedures adopted for handling uncertainty are in line with the Precautionary 
Principle and ensure that a lack of certainty is not a reason for not taking preventive 


action. 
Sets out: 


the architecture of health and safety law; 

the constraints that must be taken into account when introducing health and safety 
legislation; 

the procedure adopted for identifying the hierarchy of options for new regulatory 


measures. 


Examines some issues relevant to assessing risk reduction options, including: 


the implication of case law on 'reasonably practicability’; 


the protocols and procedures adopted for conducting a cost benefit analysis and for 


ensuring consistency when comparing costs against benefits. 


Gives some statistics for comparing risks from different hazards. 


PART 1 : OVERVIEW OF RISK AND RISK MANAGEMENT ISSUES 


Why the need to explain decisions on the management of risk? 

1 The risk of suffering harm is an inescapable aspect of living. Nevertheless, there has been 
tremendous progress in improving many aspects of the quality of our lives. We now live longer 
than at any time in history; products for use at home and at work are safer and more reliable 
than ever before. Although accidents at work still occur all too frequently, the trend averaged 


over the years has been markedly downwards. 


2 This progress in the quality of our lives is readily acknowledged but, paradoxically, it has 
been accompanied by an increased expectation for a society free of involuntary risks. The rapid 
technological developments of recent years have introduced new hazards but also enhanced the 
scope for controlling existing hazards. Though people accept that we should continue to take 


advantage of advances in science and technology, this is moderated by expectations that: 


= those who create risks should be made responsible for ensuring that adequate 
measures are in place to protect people and the things they value from harmful 


consequences that may arise from such risks; 


= the State should be proactive in protecting people from risks as distinct from reacting 


to events. 


3 Such expectations are counterbalanced in a free market economy by an underlying 
presumption that industry should be able to take advantage of new technologies, unfettered by 


State intervention as far as possible. 


4 It was such conflicting pressures that led the Government, in an initiative supported by all 
parties in the political spectrum, to undertake in the early seventies a fundamental review’, 
under the Chairmanship of Lord Robens, of the way occupational risks are regulated and 
managed. The result is that all risks to health and safety arising from workplace activity in 
Great Britain are regulated through a single legal framework - the relevant statutory provisions 
which include the Health and Safety at Work Etc. Act 1974 (HSW Act) - and by a single set of 
institutions - the Health and Safety Commission (HSC) and the Health and Safety Executive 


(HSE). 


Safety and Health at Work : Report of the Committee, Cmnd 5034; HMSO, London, 1972. 
3 The HSC is the statutory body responsible for the administration of the HSW Act. Its primary 


5 


5 A fundamental principle underpinning the HSW Act is that those who create risks from 
work activity are responsible for protecting workers and the public from the consequences. 
Thus, the HSW Act places specific responsibilities on employers, the self-employed, employees, 
designers, manufacturers, importers, suppliers and people in charge of premises. Associated 


legislation places additional duties on owners, occupiers, licensees and managers. 


6 Regulations have also been introduced clarifying these duties, requiring people such as 
employers and the self-employed to assess risks and to base their control measures on the 
results of the assessments. Where hazards entailing severe consequences are involved, the trend 
in recent years has been to amplify the duties for generic risk assessments to require the 
production of safety cases. These require duty holders to write down and submit to HSE the 
measures they have in place or intend to introduce to meet their legal obligations and ensure 


safe and healthy systems of work and the proper management of health and safety. 


7 In short, since 1974 the trend for managing risk at work has been to merge and centralise 
the authorities responsible for occupational health and safety but to clarify responsibilities in 
criminal law for managing risks in particular circumstances through the establishment of 
regulatory regimes whereby broad general duties are explicitly put on those who are best placed 
to do something about preventing or controlling the risks. The broad duties are supplemented 
by specific regulations. Many of these regulations place absolute duties on dutyholders. 
Others, however, like the broad general duties are qualified by expressions such as "so far as is 
reasonably practicable" (SFAIRP)* in order to avoid the imposition of duties that no one can 
fulfil - because absolute safety cannot be guaranteed - and in order to ensure that preventive and 


protective actions are commensurate with the risks. 


8 The general approach is to set out the objectives to be achieved and to give considerable 
freedom to dutyholders as to the regime they should put in place to meet these objectives. 


However, this is not universal. As explained later in this document, there are circumstances 


function is to make arrangements to secure the health, safety and welfare of people at work, and the 
health and safety of the public, in the way undertakings are conducted - including proposing new laws 
and standards, conducting research, providing information and advice, and controlling the storage and 
use of explosives and other dangerous substances. 


The HSE advises and assists the HSC in its functions. It has some specific statutory responsibilities 
of its own, notably for the enforcement of health and safety law; the licensing of nuclear power stations 
etc. Local authorities also have statutory responsibilities for enforcement of health and safety law. 
These apply mainly in the distribution, retail, office, leisure and catering sectors. 

This is not the only qualification. There are other similar qualifications such as "as low as 
reasonably practicable" (ALARP); "as low as reasonably achievable" (ALARA). 


6 


where the enabling powers of the HSW Act have been used to enshrine in regulations specific 
measures for ensuring that the risks from certain hazards are properly controlled - extending in 
certain circumstances to proscriptions or to the establishment of a licensing or permissioning 


regime for certain activities. 


9 A similar trend towards centralisation of regulatory authorities and the adoption of 


self-regulatory regimes is found in other areas, eg the environment. 


10 For a self-regulatory regime to work, dutyholders must have a clear understanding of what 
they must do to comply with their legal obligations. It is therefore not surprising that HSE, as 
the regulator responsible for implementing the law on health and safety, is being pressed with 
increasing frequency for explanations of how risk issues are addressed, both in general and in 
particular circumstances, so that the risks are regarded as tolerable to those affected by them. 
In this context 'tolerable' does not mean ‘acceptable’. It refers instead to a willingness to 
live with a risk so as to secure certain benefits and in the confidence that the risk is one that is 


worth taking and that it is being properly controlled. 


11 Providing such an exposition on the risk decision-making process is not an easy task. The 
process is inherently complex, with a variety of inputs. It has to be workable whilst allowing 
considerable discretion to the regulator and duty holders. At the same time, it must reflect the 
values of society at large on what risks are unacceptable, tolerable or negligible. Any genuine 


discussion quickly raises ethical, social, economic and scientific considerations, for example: 
= whether certain hazards should be entertained at all; 


= how to maximise benefits to society through taking account of advances in scientific 
knowledge and technology while ensuring that undue burdens with adverse economic 


and social impact or consequences are not imposed on the regulated; 


# the need to avoid the imposition of unnecessary restrictions on the freedom of the 


individual. 


12 The reform of the law relating to health and safety at work, set in train by the HSW Act 
itself, has proceeded over the past twenty-five years or so by taking such considerations into 
account. The approach has evolved - and is still evolving - through the formulation of 
regulations, Approved Codes of Practice and guidance spanning an enormous variety of 
industrial activity. The evolution has taken place under many influences which need to be 


reviewed in order to set the approach in its full context. This review is the subject of Part 2 
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following, and leads on to a description in Part 3 of the approach to regulation designed to 


ensure that risks that are taken are tolerable in the sense already described. 


> 


In short the aim of this discussion document is to: 


open to scrutiny HSE's approach to the regulation of risk and the philosophy 
underpinning it; 

make transparent the factors that inform our decisions on risks, for example how 
account is taken of the scientific knowledge of the risks concerned, the technology 
available for controlling them, public attitudes towards the risks and the benefits they 
engender, and show how these shape the form and content of our regulations and 
guidance; 

help reassure the public that industry, in taking advantage of technological advances, 
will not be allowed to impose unnecessary risks on people; 

let other regulators, whose responsibilities may overlap with those of HSE, know the 


basis for the management of occupational health and safety risks and thereby help to 


promote consistency of decision-making amongst regulators. 


PART 2 : REVIEW OF DEVELOPMENTS THAT HAVE INFLUENCED OUR 
DECISION-MAKING APPROACH 


Developments and influences 


14 The Robens Committee's diagnosis of the issues at stake when regulating for health and 


safety still holds good, namely that: 


= health, safety and welfare at work could not be ensured by an ever-expanding body of 


legal regulations enforced by an ever-increasing army of inspectors; 


# primary responsibility for ensuring health and safety should lie with those who create 


risks and those who work with them; 


# the law should provide a statement of principles and definitions of duties of general 


application, with regulations setting more specific goals and standards. 


15 Though the above diagnosis still underpins our approach for reaching decisions on the 
management and regulation of risks, the approach has also evolved to take into account 
developments that have arisen over the past 25 years. There is nowadays a better understanding 
of how people view risks. Changes have also taken place in the regulatory environment and on 
the industrial scene. Finally, within a generation, there have been some marked shifts in the 
preferences, values and expectations of our society. This review examines some of these 
developments - particularly those which have influenced the decision making process and 


criteria described in Part 3. 
Advances in knowledge on how people view risks 


16 How people view risks and apply value judgements is perhaps the most challenging factor 
to take into account when developing an approach to the regulation of risk - not least because 
these views and value judgements are not static but change according to circumstances. Recent 
studies have shown that as mankind has evolved to cope with the dangers and uncertainty of 
life, we have all been provided with in-built mechanisms for dealing with risk - mechanisms that 


reflect our personal preferences and the values of the society in which we live. 


17 We all recognise that, as an inescapable fact of life, we are surrounded by hazards - all 
with a potential to give rise to unwanted consequences. Less apparent is that whatever we do, 
however we occupy our time or even if we ‘do nothing’, we are taking some kind of risk. Even 


at home there are myriad risks - we could get hurt, for example, in a house fire or when doing 


og 


DIY jobs. If we did something else, we would be taking other kinds of risks. Some of the risks 
we face may be from naturally occurring hazards while others may arise from our lifestyle and 


are risks we take willingly to secure some wanted benefits; eg facing traffic to cross the road. 


18 Moreover, everyday, consciously or unconsciously, we all view hazards and evaluate their 
risks to determine which ones we choose to notice, ignore or perhaps do something about. We 
may take the consequences of some risks for granted and, for others, consider that our own 
chances of being harmed may be either more or less than the average, depending on the 
apparent degree of control we have for taking or limiting the risks, eg whether we are more 


nimble, younger, have better sight and so on. 


19 In short, the way we all treat risks depends on our perception of how they relate to us and 
things we value. It is only fairly recently that social scientists have examined in detail what 
factors affect people's perception of risk. They have found that there is a wide range of factors. 
Particularly important for man-made hazards are "how well the process (giving rise to the 
hazard) is understood, how equitably the danger is distributed and how well individuals can 


control their exposure and whether risk is assumed voluntarily". 


20 Other studies® on perception of risk have led to a theory which considers that it may be 
simplistic to believe that there is a derivable quantifiable physical reality that most people will 
agree represents the ‘true’ risk from a hazard. This theory argues that the concept of risk is 
strongly shaped by human minds and cultures. Though it may include the prospect of physical 
harm, it may include other factors as well, such as ethical and social considerations, and even 
the degree of trust in the ability of those creating the risk (or in the regulator) in ensuring that 


adequate preventive and protective measures are in place for controlling the risks. The logical 
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Fischoff B., Slovic P., Lichtenstein S., Read S., and Combs B. (1978). “How safe is safe enough? 
A psychometric study of attitudes towards technological risks and benefits". Policy Sciences, 9, 
127-152. 
° M.S. Douglas and A. Wildavsky, "Risk and Culture", University of California Press, Berkeley, 
1982. 
S.O. Funtowicz and J.R. Ravetz, "Three Types of Risk Assessment and the Emergence of 


Post-normal Science" in "Social Theories of Risk", ed. S. Krimsky and D. Golding, Praeger, Westport, 
Connecticut, 1992, p. 251-274. 


N.C. Pidgeon, C. Hood, D. Jones, B. Turner, and R. Gibson, "Risk: Analysis, Perception and 
Management", The Royal Society, London 1992, p. 89-134. 


B. Wynne, "Risk and Social Learning: Reification to Engagement" in "Social Theories of Risk", ed. 
S. Krimsky and D. Golding, Praeger, Westport, Connecticut, 1992, p. 275-300. 
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conclusion drawn from the theory is that it is human judgement and values that determine which 


factors should be defined in terms of risk and actually made subject to analysis. 


21 The theory has been used to explain why, for many new hazards, high quality risk 
assessment by leaders in the field often fails to re-assure people. Even using all available data 
and best science and technology, many risk assessments cannot be undertaken without making a 
number of assumptions such as the relative values of risks and benefits or even the scope of the 
study. Parties who do not share the judgemental values implicit in those assumptions may well 
see the outcome of the exercise as invalid, illegitimate or even not pertinent to the problem - as 
exemplified by the controversy surrounding the proposal to dispose of the Brent Spar oil 


platform in the middle of the ocean. 


22 Social scientists have also proposed another theory’ for explaining why risks that are minor 
in quantitative terms at times produce massive reactions while major risks are often ignored. 
Their social amplification of risk model suggests that the impact of a particular risk begins with 
the initial victims and diffuses outward to society at large. In that process, public response to 
the risk can be amplified or attenuated depending on how the reporting of the risk interacts with 


psychological, social, cultural, and institutional processes. 


23 For example, awareness of the risk of air travel following an airline crash can be amplified 
by a large volume of information, scientific experts challenging one another, dramatisation of 
the issue and use by the media of value-laden terminology and images. This perception can then 
be further amplified or attenuated depending on the effects of such media exposure on the 


community and society as a whole. 


24 These and other studies have established that hazards give rise to concerns which can be 


put into two broad categories. 


1) Individual concerns or how individuals see the risk from the hazard affecting them 
and things they value personally. This is not surprising since one of the most 
important questions for individuals incurring a risk is how it affects them, their family 
and things they value. Though they may be prepared to engage voluntarily in 
activities that often involve high risks, as a rule they are far less tolerant of risks 
imposed on them and over which they have little control, unless they consider the 
risks as negligible. Moreover, though they may be willing to live with a risk that they 


7 Kasperson R. E., Renn O., Slovic P. et al. (1988). "The social amplification of risk: A conceptual 
framework". Risk Analysis, 8(2), 177-187. 
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do not regard as negligible, if it secures them or society certain benefits, they would 


want such risks to be kept low and clearly controlled. 


ii) Societal concerns or the risks or threats from the hazard which impact on society as a 
whole. This type of concern is often associated with hazards that give rise to risks 
which, were they to be realised, could provoke a socio-political response, eg risk of 
events causing widespread or large scale detriment. Typical examples relate to nuclear 


power generation, railway travel, or the genetic modification of organisms. 


25 Hazards giving rise to societal concerns share a number of common features. They often 
give rise to risks which could cause multiple fatalities; where it is difficult for people to estimate 
intuitively the actual threat; where the risks and benefits tend to be unevenly distributed, not 
only between groups of people with the result that for example some people bear more of the 
risks and others less of them, but perhaps also through time so that less risk may be borne now 
and more by some future generation. People are more averse to those risks and in such cases 
are therefore most likely to insist on stringent Government regulation. The opposite is true for 
hazards that are familiar, often taken voluntarily for a benefit, and individual in their impact. 


These do not as a rule give rise to societal concerns. 


26 In addition to the direct societal concerns about the impact of the hazards on those 
affected, there is also and importantly a concern that the stability of the political system would 
come under threat in the wake of a catastrophe, however remote the chance of its happening. 
The consequential fear is a loss of trust by the public in the regulator and Government. 
Consideration of how regulation should approach hazards of this kind is intensely political and 
usually described on a case-by-case basis. A prime consideration is the affordability of measures 
to eliminate the hazard relative to the total detriment suffered by society in the event of the 
hazard being realised. An eloquent account of Government decision-making under such 


circumstances, relating to the Thames barrier, has been given by Bondi’. 


Changes in the regulatory environment 
27 We explore below some of the marked changes that have taken place in the regulatory 


environment since Robens. 


* _H. Bondi, " Risk in Perspective", in Risk : Man-made Hazards to Man, p8-17, Edited by 
M. G. Cooper, Clarendon Press, Oxford, 1992. 
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The internationalisation of regulation 

28 The regulation of risk is nowadays increasingly being undertaken at European or 
international level in the form of legally binding instruments on Member States - such as 
directives adopted in the wake of the creation of new global markets and new technologies. For 
some of the new risks, like those arising as a result of the release of genetically modified 
organisms, action will clearly have to be taken at international level to have any effect. 
Moreover, in other areas the technology is moving so fast that de facto international standards 
or practices are evolving all the time, eg in ensuring the safe use of computerised systems for 
controlling plant and machinery. Many countries are calling for such technologies to be 


regulated at international level as the only effective way to prescribe appropriate standards. 


29 The pressure towards the internationalisation of regulation not only requires innovative 
forms of regulatory co-operation but must take into account a host of other factors such as 
agreements for regulatory harmonisation, mutual recognition of standards and removal of 
barriers to trade - particularly since the legal instruments used for that purpose (eg directives) 


take precedence over national legislation. 


Increased complexity in the regulation of risk 

30 Throughout the long history of legislation introduced to eliminate or minimise risks, the 
first areas to be regulated have always been the most obvious, often requiring little scientific 
insight for identifying the problem and possible solutions. For example, it was not difficult to 
realise that controlling airborne dust would reduce the risk of silicosis in miners and that making 
it mandatory to guard moving parts of machinery would prevent workers from being killed or 
maimed. In short, dramatic progress towards tackling such problems could be (and was) made 


without unduly taxing existing scientific knowledge or the state of available technology. 


31 However, as the most obvious risks have been tackled, new and less visible hazards have 
emerged and gained prominence. Typical examples include those arising from technologies 
such as biotechnology, and processes emitting gases which contribute to global warming and 
ozone depletion. One frequent characteristic of these new hazards is that it can be very difficult 
to define precisely the risks they may give rise to, even when scientific knowledge is pushed to 
the limit. The processes that may give rise to risks are only partially understood with the result 


that regulatory decisions must frequently be based on limited data and considerable scientific 
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and technological uncertainties. The control measures required by regulation should reflect the 


nature of the uncertainties and err on the side of health and safety. 


32 Moreover, whereas in the past agreement, on the action necessary could usually be 
reached on the basis of the degree of risk posed by a particular hazard as assessed by applying 
theories from natural sciences, engineering, logic and mathematics, this is no longer the case. 
This approach is no longer sufficient to counter the growing demand that regulation of risks 
should take account of the quality (or attributes) of the hazard as distinct from objective 


assessment of the quantity of risk. 


33 It has become a matter of course to request, for example, that taking into account 
undesirable consequences should include consideration of matters such as distributional or 
economic equity or ethical considerations’ or, for those occupational risks that are often 
accompanied by secondary environmental risks, whether it is morally right to adopt policies 
without considering their effects on natural phenomena like the survival of species and the 
maintenance of ecosystems'®. In short, the concept of risk has evolved to include values that 


cannot readily be verified by traditional scientific methods. 


34 This has led to disagreements about the role that risk assessment should play in the 
regulation of risk - complicating matters still further. It has become a recent fashion by some to 
campaign against the use of risk assessment in the decision-making process, particularly for 
large scale risks. Many of the criticisms voiced about the role of risk assessments are based on 
mistaken beliefs about how such assessments are undertaken and applied. For example, it is 


often argued that an approach based on assessment of the risks: 


# is inadequate since it often reduces the characteristics of what is in many instances a 
complex issue to a single number and is therefore weak in taking into account societal 
concerns or other important factors such as the degree of trust between regulators and 


their stakeholders (see para 20 above); 
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= often underestimates the true impact of a problem overall. For example, a risk 
assessment is always undertaken for a specific purpose and with a specific population 


in mind and may therefore ignore risks to another population; 


" is used capriciously to legitimise decisions, for example, to allow an unpopular 


development in one area but not in another; 


= can be misused to present a particular problem as being primarily one of risk and 
could thereby undermine the adoption of a precautionary approach based on 


anticipating and averting harm. 


35 However, the counter view - which we hold - is that there is overwhelming evidence that, 
properly used, the results of a risk assessment often provide an essential ingredient in reaching 
decisions on the management of risk. The proper use of a risk assessment would require inter 


alia that: 


= more often than not, the results of a risk assessment should be expressed as a value 


judgement rather than a number; 
# the risk problem should be properly framed; 
= the nature and limitations of the risk assessment are understood; and 


# the results of the risk assessment are used to inform rather to dictate decisions and are 


only one of the many factors taken into account in reaching a decision. 


Clarification by the Courts on the meaning of hazard 

36 Arguments on the meaning that dutyholders should attach to the concepts of ‘hazard’ and 
‘risk’ when complying with their legal duties to ensure the health and safety and welfare of 
people, may have contributed to the disagreements on the role that risk assessment should play 


in the decision-making process. 


37. The concepts of hazard and risk are enshrined in our everyday vocabulary. When people 
say that they are prepared to take a risk they mean that in taking a particular decision they are 
willing to incur a chance of adverse consequences happening in the expectation of a probable 
benefit (ie a positive consequence). Intrinsic in that definition is that ‘risk’ should reflect both 
the likelihood that some form of harm may occur and a measure of the consequence. In 


everyday life, though we are likely to pay more attention to consequences than to likelihoods. 
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38 Nevertheless, it has proved useful to make a conceptual distinction between a hazard and a 
risk by describing a hazard as an intrinsic property or disposition of anything to cause harm and 
risk as the chance that someone or something that is valued will be adversely affected in a 
stipulated way by the hazard. HSE frequently makes use of the above conceptual distinction in 
its guidance by requiring that hazards be identified, the risks they give rise to are assessed and 
appropriate control measures introduced to address the risks. This reflects the fact that in most 
cases it makes sense to take account of the circumstances in which people and management 


systems interact with the hazard. 


39 But, there will also often be cases where the distinction between hazard and risk is blurred 
in actual practice. HSE, for example, might attach a different weighting to the likelihood that 
harm will occur from the weighting attached to the consequences. The more weighting we 
attach to the consequences, the more we blur the distinction between hazard and risk. And 
should we choose to concentrate solely on the consequences, the distinction disappears, the 


possibility of the consequences taking complete priority over the chance. 


40 However, the use of the latter approach by HSE has been challenged by some - perhaps 
because the HSW Act makes reference to ‘risk’ but not 'hazard'. In that respect, a ruling by the 
Courts on the meaning of ‘hazard' for the purpose of the HSW Act is very relevant. The Court 
of Appeal in Regina vs Board of Trustees of the Science Museum, 1993, noted that 'hazard' and 
'risk' are often used interchangeably. They understood the arguments why conceptually it was 
useful to make a distinction between these two terms. However, the Court ruled (see below) 
that, as far as the use of 'risk' in the HSW Act was concerned, this word should be interpreted as 


conveying the idea of a possibility of danger, or what conceptually is regarded as ‘hazard’. 


"The starting point must be the ordinary meaning of the language of section 
3(1). In our judgement the interpretation of the prosecution fits in best with 
the language of section 3(1). In the context the word 'risks' conveys the idea 
of the possibility of danger. Indeed, a degree of verbal manipulation is 
needed to introduce the idea of actual danger which the defendants put 
forward. The ordinary meaning of the word 'risks' therefore supports the 
prosecution's interpretation and there is nothing in the language of section 3 
or indeed in the context of the Act, which supports a narrowing down of the 
ordinary meaning. On the contrary the preventive aim of sections 3, 20, 21 
and 22 reinforces the construction put forward by the prosecution and 
adopted by the judge. The adoption of the restrictive interpretations argued 
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for by the defence would make enforcement of section 3(1) and to some 
extent also of sections 20, 21 and 22 more difficult and would in our 
judgment result in a substantial emasculation of an essential part of the Act of 
1974. The interpretation which renders those statutory provisions effective in 
their role of protecting public health and safety is to be preferred. 


We have not lost sight of the defence submission that we ought to 
concentrate on the word 'exposed' rather than 'risks' in section 3(1). If the 
word 'risks' has the meaning which we consider it has, the point disappears. 
In that event exposure to a possibility of danger is sufficient. The word 
‘exposed’ simply makes clear that the section is concerned with persons 
potentially affected by the risk... But the word ‘exposed' cannot change the 
meaning of 'risks' from a possibility of danger to actual danger. On the 
principal points in this case the argument for the defence is really a red 
herring." [1993] 1 WLR 1171 at page 1177. 


41 The implication of this interpretation is that, to be successful, approaches for 
managing risks in the workplace must ensure that hazards present are properly 
addressed. As we shall see later, the processes and criteria described in Part 3 meet this 
important condition. For example, they ensure that for hazards surmised to have consequences 
that may be irreversible and deleterious, ie entailing a high possibility of danger, there is an 
overriding need to introduce control measures for addressing the hazards even when there is 


considerable uncertainty about the nature of the hazards. 


Changes on the industrial scene 

Changes in patterns of employment 

42 The regulatory environment now has to cope with the increasing trend in industry and 
elsewhere to outsource work and hence risks, with changes in patterns of employment and with 
the fragmentation of large companies into autonomous symbiotic organisations. For example, 
there have been dramatic increases in self-employment and home-working; small and medium 
size firms are now a major force in creating jobs; and a monolithic railway organisation has 
become a series of separate companies with different responsibilities for operating the track, the 


rolling stock and the networks. 


Polarisation of approaches between large and small firms 
43 Some of these changes have blurred legal responsibilities for occupational health and 


safety, traditionally placed on those who create the risks or on those best situated to take steps 
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to control the risks. In certain industries it is often no longer easy to determine who may be in 
such a position. Though case law has in many instances clarified the situation, the fact remains 
that for many sectors the above factors make it more difficult to co-ordinate the adoption of 
measures for controlling risks. Many more players are involved, some with little access to 
expertise. There has in consequence been a growing demand by small firms for a reversion to 
prescriptive regulation, running counter to the self-regulatory approach - a demand resisted by 
large firms, which not facing the same problems, are very much at ease with the self-regulatory 
approach. This has resulted in greater emphasis being placed on the need for clarity of the 


status and content of the guidance element of the architecture (see Annex 2) of regulation. 


Changes in the preferences, values and expectations of society 
44 The preferences, values and expectations of society have never been static. Current shifts 


are linked in part to: 


= the rapid rise in information technology which nowadays plays an important role in 
shaping perceptions by making it easier for people to have information on the risks 
that may affect them and the society (or indeed the planet) in which they live. This 
explosion in information technology has, for example, resulted in greater awareness of 
issues such as the Chernobyl accident, the toll of asbestos related deaths, the threats 
to the ozone layer. Unfortunately information about risks is frequently passed on in 
isolated bits by the mass media and without any critical examination or peer review - 
often resulting in the public getting confused or in some risks being amplified while 


others are attenuated; 


" the increased pace in exploiting advances in scientific and technological knowledge, 


which has led to an increased focus on technological risks; 


= greater affluence in society. The majority of people in industrialised countries no 
longer have to struggle at subsistence level. As a consequence, the acceptance of 
industrial activity to gain increased standards of living is no longer as readily given as 


when the fight against hunger and poverty overshadowed everything else. 


45 These shifts in preferences and values result in: 
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A growing perception that risks imposed on people should be justified 
46 There is a growing propensity to scrutinise benefits brought about by industrial activity 
against potential undesirable side effects such as the risk of being maimed or killed or of 


environmental pollution. This is particularly true for risks: 
# which could lead to catastrophic consequences; 


= where the consequences may be irreversible, eg the release of genetically modified 
organisms; 
# which lead to inequalities because they affect some people more than others, such as 


those arising from the siting of a chemical plant or a waste disposal facility; 


# which could pose a threat to future generations, such as radioactive waste. 


47 This has already resulted in industry having less discretion on matters on which they 
previously had considerable freedom to decide which course of action to adopt; eg plans for 
modifying their plant within their own boundaries, what raw materials and processes they 
should use, or how the waste generated (or the plant itself at the end of its useful life) should be 
disposed of. 


An increasing reliance by the public on regulators that they trust 
48 A heightened perception of risk has been accompanied by a recognition that modern 
society has evolved in such a way that it is virtually no longer possible for many of its individual 


members to: 


# avoid risks that they would have preferred not to incur. For example, a person who 
does not want to travel by motor car or by plane may find their employment or 
promotion opportunities severely restricted. A person wanting to avoid processed 
food because of their fear of additives would only be able to do so at great expense or 


by having a restricted way of life; 


= assess for themselves the risks posed by many of the newer hazards arising from 
industrialisation. This often may be because the risk is not immediately obvious, eg 
the risks from new hazardous substances which do not cause immediate acute effects 
and for which there might be long delays between first exposure and the manifestation 
of undesirable symptoms. People must rely instead on the opinion of experts. 


However, the trust placed in expert opinion as a source of reassurance is being 


19 


continually eroded, particularly for those issues where the mass media seek to expose 


controversies surrounding such opinions. 


49 The net result is that, increasingly, people are having to rely on authoritative bodies such 
as HSC/E as a source of reassurance. These bodies for their part are acutely aware that they 
would not be able to provide reassurance unless they are trusted and that trust will not be 


bestowed but will have to be earned. 


50 This is far from easy. There is often considerable pressure on regulators (and industry) to 
act quickly and decisively in a climate heavily influenced by perceptions of harm often based on 
graphic imagery. Regulating slavishly on such occasions is not the answer. Regulating to 
address concerns, which with hindsight turn out to be no more than transitory shifts in value 


preferences, carries heavy penalties. 


Calls for greater openness and involvement in the decision-making processes 

51 Perhaps the most dramatic shift in value preferences of society has been the pressure on 
regulators for greater clarity and explanation of their approaches to the regulation of risk. This 
is reflected in the broadly stated principles of good regulation published by the Better 


Regulation Task Force'’. These require: 
# the targeting of action: focusing on the most serious risks or where the hazards are 


less well controlled; 


= consistency: adopting a similar approach in similar circumstances to achieve similar 


ends; 

" proportionality: requiring action that is commensurate to the risks; 

" transparency: being open on how decisions were arrived at and what are their 
implications; and 


= accountability: making clear, for all to see, who are accountable when things go 


wrong but without resorting to unfair retribution. 


52 This need for clarity and explanation is entirely consistent with the Robens Committee's 
conclusion that real progress on health and safety is not possible without the agreement of those 
affected and the co-operation and commitment of those playing a role in implementing 


decisions. 





"' ‘Principles of good regulation’. Available from Better Regulation Task Force, Room 72q/2, Horse 


Guards Road, London SW1P 3AL. 
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53 Though all the developments described in this Part have influenced our approach, the 


following have been particularly important: 


= the need for the meaning of 'risk' to encompass more than physical harm by taking into 


account other factors such ethical and social considerations (paras 20-26); 


# clarifications by the Courts on the meaning of hazard which implies that approaches 
for managing risks must ensure that hazards present are properly addressed (paras 


36-41); and 


= how we apply the principles at para 51 above. 


54 The rest of this document sets out how we have taken these developments on board 


building on our previous approach. 
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PART 3 - APPROACH TO REACHING DECISIONS ON RISK 


System for informing and reaching decisions 

55 In this part we build upon the developments described in the review in Part 2 to explain the 
approach that HSE adopts for reaching decisions on risk issues. This includes both the system 
used for informing and reaching decisions and the criteria and philosophy adopted for deciding 


on what risks are unacceptable, tolerable or negligible. 


56 Many systems have been developed for informing and reaching decisions, and some 
particularly pertinent to health and safety have been described’. The following stages 
characterise the system, governed by the principles set out in para 51, that has evolved in HSE 
in the course of undertaking its own statutory responsibilities and in advising and assisting the 


HSC, for example in implementing policies on modernising health and safety legislation. 
i) Deciding whether the issue is primarily one for HSC/E. 
ii) Defining and characterising the issue. 
iii) Examining the options available for addressing the issue, and their merits. 


iv) Adopting a particular course of action for addressing the issue, informed by the 
findings of (ii) and (iii) above and in the expectation that as far as possible it will be 


supported by stakeholders. 
v) Implementing the decisions. 


vi) Evaluating the effectiveness of actions taken and revisiting the decisions and their 


implementation if necessary. 


57 We examine, in further detail below, what is involved at each stage. However, it is worth 
emphasising three points. First, though the stages as listed above give the impression that they 
are distinct and independent of each other, in practice the boundaries between them are not 
clear cut. We usually gather valuable information or perspectives while progressing from one 
stage to another, often requiring early stages of the process to be revisited. In short we find 


that going through the stages is an iterative process. 


'2 The Presidential/Congressional Commission on Risk Assessment and Risk Management, 


‘Framework for Environmental Health Risk Management’, Final Report Volume 1 (1997). The 
Commission on Risk Assessment and Risk Management, 529 14th Street, Washington DC. 
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58 Secondly, we involve stakeholders at all stages in the above process with the aim of 
reaching a wider consensus. However, we are conscious that HSC/E must take final decisions 
where consensus is not possible, for example, because different stakeholders hold opposite 


views based on deep-rooted beliefs. 


59 Thirdly, as a corollary to the first point, how we proceed through the above stages is not 
encapsulated in a single document but is reflected, for example, in the way we assist HSC and 
its Advisory Committees to go about their business, the consultative documents that we publish, 
the responses to such consultation, and discussions that take place with our stakeholders, both 


formal and informal. 


Stage 1 - Deciding whether the issue is one for HSC/E 
60 The scope of the HSW Act is very wide and it will usually be self-evident that an issue or 
object of concern is primarily one of occupational health, safety and welfare. These issues or 


objects of concern can arise through many ways. The most important are: 


= pressure of events and experience in terms of statistics of accidents and ill-health and 


reports of investigations into particular accidents; 
# public perceptions that there is a problem to be addressed; 


# feedback that existing arrangements are not fit-for-purpose, for example in imposing 


unnecessary burdens on duty-holders; 
# political moves in Europe or internationally to which we have to respond; 


= intelligence on new hazards for example from new technologies, or inadequacies in 
existing arrangements to cope with change, for example, in the pattern of 


employment. 


61 However, it is not often appreciated that the objectives of the HSW Act include not only 
the securing of the health and safety and welfare of people at work but also the protection of 
people not at work against risks to their health and safety arising out of work activities. The 
wide scope of the Act, together with its wide-ranging enabling powers to make regulations, 
often result in pressure on HSC/E to take the lead in protecting the public, in the interest of the 
workability and effectiveness of the arrangements that can be put in place under health and 
safety legislation and/or its enforcement - aside from the practical consideration that other 


institutions with relevant powers may not exist within the Government machine. 


a 


62 Such considerations have arisen particularly in the case of activities with minimal 
involvement of employees but with the potential to cause harm to the public and where the 
relevance of health and safety 'at work' legislation may not be obvious. Typical examples 


include golf courses, horse-riding establishments and pop-concerts. 


63 The wide scope of the HSW Act and its considerable enabling powers to make regulations 
have resulted in two other effects. Firstly, many of its provisions and regulations made under 
the Act overlap with other legislation which is the responsibility of other Government 
Departments. To avoid duplication of work where policy areas overlap, there are often 
demarcation agreements between HSE and other Departments on respective responsibilities 
covering many areas of potential risks to the public. As a rule, if a risk is subject to specific 
legislation, HSE will not attempt to enforce the general duties of the HSW Act in situations 


where public safety will be adequately guaranteed by the enforcement of the specific legislation. 


64 Secondly, pressure on HSC/E is at times targeted at issues where health, safety and 
welfare is not a prime consideration but might be seen as a means of objecting to an uneven 
distribution between those who reap the benefits and those who are put at a detriment of some 
sort that may include a health and safety component, eg the loss of a visual amenity in the 
vicinity of a scenic spot or a fall in property values as a result of allowing a major installation, 


such as an airport, to be developed. In these circumstances, we may advise the HSC: 


i) that public debate and discussion on the distribution and balancing of the benefits and 
detriments involved should take place in a wider context, and that it would therefore 
be better for the issue to be addressed and/or regulated through a more appropriate 


avenue in the political and democratic system; or 


ii) to deliberately limit its consideration of the issue by looking only at the health, safety 
and welfare aspects entailed in the particular context. That is to look at the 
appropriateness of the measures in place to protect workers and the public from the 
risks arising from the activity but leave wider aspects - such as whether the activity 
should be entertained in the first place - to be considered by the political and 
democratic system as per (i) above. For example, HSE has made it clear’’ that in its 


consideration of the tolerability of risks from nuclear power stations, it has limited its 





13 


Michael Barnes, Hinkley Point C Inquiry report, Transcript of Proceedings, 1989. J L Harpham 
Ltd, 55 Queen Street, Sheffield, $1 2DX. 


Reference 12, para 190. 
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analysis to the consideration of the safeguards that should be in place and the way 
they should be exercised, and has left it for Parliament to weigh the benefits of nuclear 


power against the risks entailed. 


65 A quite different issue arises when a European directive is enacted under Article 118A, the 
health and safety article of the Treaty of Rome. It is not always the case that matters covered 
by a 118A directive are interpreted as health and safety matters in Great Britain. Such a 
question arose when we had to advise the HSC on whether the enabling powers of the HSW 
Act should be used to introduce regulations to implement an EC health and safety directive on 
working time. We (and the HSC) were not convinced that all elements of the directive (eg paid 
annual leave) were primarily an occupational health, safety and welfare issue, and agreement 
was reached with Ministers that the enabling powers of the HSW Act should not be used to 


implement them. 


66 In short, if an issue ends up being regulated under health and safety legislation, it is 
invariably the result of careful consideration of all the factors involved, such as those described 


above. 
Stage 2 - Defining and characterising the issue 
Defining the issue 


67 In this stage we consider how the issue can be framed or described in terms of problems to 


be tackled and the means for tackling them. 


68 For example, the retention of older rolling stock on the railways is an issue with two quite 


different dimensions: 
i) of transport policy, in discouraging the wider use of public transport; and 


li) of public safety policy, in denying the public the safety benefits of modern rolling 


stock. 


The issue could be framed either way, giving rise to quite different problems to be tackled 


by the different arms of the Government regulatory machine. 


69 In framing an issue we shall therefore pay particular attention as to whether: 


= the action to be taken can be efficiently delivered by HSE acting within their powers 


and arrangements as discussed in paras 60-66 above; and 
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= society at large will regard as valid the whole process that was adopted for reaching 
the decision on the most appropriate course of action for addressing the issue. This is 
because, as we have already seen, the way an issue is framed can have a considerable 
influence on judgements about whether risk is actually the crux of the issue and, if so, 


the effectiveness of the measures that should be put in place for addressing the risk. 


70 Areas of particular contention arise when there is a divergence between public perceptions 
that there is an issue to be addressed and objective analysis of the associated problems in health 
and safety terms. There may then be a need for iteration between this stage and the first stage 
described earlier (paras 60 et seq.). We sometimes uses discussion documents as a means of 


seeking convergence towards a workable option. 


Characterising the issue in terms of risk 

71 The framing of the issue may point to it being one where a decision on proportionality of 
action requires information on the risks. In such cases, we need to characterise the risk 
quantitatively and qualitatively, to describe how it arises and how it impacts on those affected 
and society at large. Such information is needed in order to inform later consideration of 


options for risk reduction. 


72 We usually undertake an assessment of the risks to achieve this. Assessing risks involves 
identifying the hazards associated with the risk issue, ie what in a particular situation could 
cause harm or damage, and then assessing the likelihood that harm will actually be experienced 


by a specified population and what the consequences would be. 


73 The process of gathering and refining information on risks is underpinned by a great deal 
of research and the engagement of expertise both within and outside HSE. The resources 
devoted to establishing sound information and intelligence on risk account for around 25% of 
HSE's total resources. External expertise is engaged through research, often carried out 
collaboratively, and through the system of HSC Advisory Committees. The science 
underpinning HSC/E policies and practices is extensively exposed to the normal scientific 
process of peer review. There is, in addition, provision in our research commissioning 
arrangements for ideas generated independently to be considered for funding in order to bring 
fresh perspectives to bear. All told, the arrangements in place for incorporating science into the 
characterisation of risk require much deliberative activity between HSE and the science 


community at large. 


74 Because we are interested in identifying both the individual risk and the societal concerns 
engendered by the hazards, and other issues such as whether the risks should be entertained at 
all or should be regulated in a particular way, the risk assessment we carry out at this stage is 
much broader than the one that we would generally expect a duty holder to undertake in 
complying with the duty to assess risks under the Management of Health and Safety at Work 
Regulations. The risk assessment under those regulations would usually concentrate on looking 
at the prospect of harm to individuals (and in some cases to society as a whole) to identify in the 
light of good practice what needs to be done to comply with the law. On the other hand, the 
assessments we carry out under this stage, more often than not, have to probe in depth in order 
to develop standards of good practice for future application. In this way, good practice comes 
to reflect the risk assessment by HSE and compliance with good practice implicitly conforms to 


a risk-based approach to control. 


75 Thus, we use a risk assessment essentially as a tool for extrapolating, from available data, 
on our experience of harm or for compressing a large amount of scientific information and 
judgement into an estimate of the risks. The policy process then couples the scientifically-based 
judgements about risks with policy considerations about the approach to their control. The 
latter (sometimes separately described as risk evaluation) embrace such considerations as the 
relative weightings to be attached to the likelihood and consequences as discussed in paras 


37-39 and the way that public perceptions of the risk should be taken into account. 


76 For example, the risk assessment may show that the risks are such that individuals may not 
be unduly concerned because of the familiarity of the risks and/or that the expectation of harm 
to any one individual is low. Nevertheless, the activity giving rise to the risks may need to be 


regulated further because of the toll of the risks on society. 


77 The proper characterisation of the risk is important to the effective application of the 
preferred risk control hierarchy originally advocated by the Robens Committee and since 
promoted by HSE and the EU. The hierarchy actually covers controls on hazards as well as the 
resulting risks. At the top of the hierarchy, and consistent with the general duty to secure health 
and safety, is the consideration of measures or alternatives that will avoid the hazard in the first 
place. This might involve substitution or the adoption of processes that conform with principles 
aimed at ensuring that a design is inherently safer. Lower down the hierarchy is the 


consideration of measures that will reduce the risks, given that there are no viable alternatives to 
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accepting the hazard. An implicit presumption underlying the hierarchy is that it is not the case 
that any activity can be pursued simply because measures are available to control the risk it 
entails. This would be particularly true for activities where there are considerable uncertainties 


in the estimates of the risks attached to them. 


Inherently safer design 


Adoption of the principles of inherently safer design is particularly important where the 
consequences of plant or system failure are high. In certain circumstances HSE may 
require plant to incorporate inherently safer design features rather than rely on ‘bolt-on’ 
safety systems or mitigation procedures to control the risk. 


The RBMK type of reactor used at Chernobyl, for example, would not be licensed by 
HSE's Nuclear Installations Inspectorate for operation in Great Britain. The design of this 
type of reactor does not satisfy HSE's requirements’ because, under certain conditions, a 
rapid increase in temperature of the reactor core can lead to an increase in the rate of the 
nuclear fission process, further increasing the temperature. Such a large ‘positive 
temperature co-efficient’ can result in rapid runaway of the nuclear reaction. This 
inherently unsafe aspect of the reactor design, coupled with experimentation by the 
Operators under conditions where other safety systems had been overridden (which would 
also not be allowed in this country), led to the infamous incident at Chernobyl in 1986. 


' Health and Safety Executive "Safety Assessment Principles for Nuclear Plants", ISBN 0-11-882043-5. 





78 Indeed, in line with our earlier discussion on the meaning of hazard at paras 36-41, the 
regulation of health and safety is replete with examples of where the hazard rather than the risk 
is the dominant consideration. This is particularly true for hazards where there is considerable 
uncertainty on the nature and scale of the risks they give rise to, eg the release of genetically 


modified organisms. We therefore need to look at uncertainty in more detail. 


Handling Uncertainty 
79 Uncertainty permeates the whole process of assessing risks. For example the science 
underpinning the assessment may be complex, ambiguous or incomplete and/or the necessary 


data may not be available. 


80 We must first distinguish between uncertainty and ignorance. The latter refers to a lack of 
awareness of factors influencing the issue. This is a well-recognised weakness in risk 
assessment - that the identification of hazards may be incomplete. The measures needed to 
counteract ignorance are a wide engagement of different disciplines and communities of interest 
in the characterisation of the issue. Para 73 described the very broad base of expertise called 


into play in HSE's consideration of the science of risk. A further measure is to practice 
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openness to the greatest degree possible so that thinking can be exposed to alternative views at 
an early stage. This is a principal requirement in the 1997 policy statement of the Chief 


Scientific Adviser’. 


An Example of a Qualitative Assessment of Risks 
Crowd Safety at the Pinner Fair 


Estimates of risk are often qualitative rather than quantitative, and are frequently based on 
Systematic observation. An example is the assessment of crowd safety risks at an annual 
fair in Pinner on the north-west outskirts of London. 


Pinner Fair was established by Royal Charter in 1337. Each year it attracts about 50,000 
people to the central streets of Pinner, where the restricted space contrasts with the 
increasing size and complexity of modern fairground rides. 


In a study in 1993 by HSE, observation of the setting up, running and dismantling of the 
fair, together with an analysis of the safety management, formed the basis for hazard 
identification and risk assessment. Comparisons were made with standards in codes of 
practice and guidance, and with good practice for comparable events. Opinions voiced by 
local residents, the local authority and the police were also taken into account. It was 
shown that straightforward changes in the organisation and layout of the fair could 
eliminate some risks and substantially reduce others. To prioritise the improvements 
needed the risks were ranked qualitatively using a five point scale from ‘very low’ to ‘very 
high’. 

The findings of the risk assessment were discussed with interested parties, including the 
local authority, the emergency services and the Showmen's Guild of Great Britain, who 
decided to adopt a series of measures to improve crowd safety. HSE evaluated the 
effectiveness of the action taken in a follow-up study in 1994 when significant 
improvements were already apparent. 


Further information: 


Health and Safety Executive guidance HSG 175 "Fairgrounds and amusement parks: 
guidance on safe practice", ISBN 0-7176-1174-4, HSE Books. 





81 Uncertainty itself is a state of knowledge in that, although the factors influencing the issue 
are identified, their effects cannot be precisely described. Uncertainty has many manifestations 


and they affect the approach to its handling. In summary: 


Knowledge uncertainty - This arises when knowledge is represented by data based on 
sparse statistics or subject to random errors in experiments. There are established 
techniques for representing this kind of uncertainty, for example confidence limits. The 
effect on a risk assessment is estimated by sensitivity analysis. This provides information 


relating to the importance of different sources of uncertainty which can then be used to 





14 ‘The Use of Scientific Advice in Policy Making’ (1997). Issued by the Office of Science and 
Technology and available from the Department of Trade and Industry, 1997. 
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prioritise further research and action, which is the only feasible way to address the 
uncertainty, though in some cases research may not be technically possible or 


cost-effective. 


Quantitative Risk Assessment 


As indicated in a previous example, estimates of risk are often qualitative rather than 
quantitative. 


A few sectors of industry, however, have focused on the tool of quantitative risk 
assessment (QRA). Whilst QRA is a useful tool, care needs to be taken to avoid 
numerous pitfalls which can trap the unwary. or example, in estimating the 
likelihood or frequency of an event by looking back at historical accident or incident 
data, care needs to be taken in selecting: 


¢ the accident/incident sample - too small a sample can lead to bias; too large a 
sample may result in the inclusion of events that developed differently from those 
in question; 


the time period - too short a period may lead to the omission of representative 
indicators; too long a period may again result in the inclusion of events that 
developed differently from those in question. Whatever time period is chosen, the 
assumption of a constant relationship between accident/incidents and time needs to 
be questioned in the light of changes in technology and increased public 
expectations; 


the statistical method - historical accident/incident data may not include the cause, 
and selective choice of the data and/or the model used can result in figures that do 
not properly reflect actual history. 


Whilst the process of undertaking a QRA can be instructive in identifying the main 
factors that contribute to a risk, the past is seldom a good predictor of the future! 
The numerical estimates that emerge from QRA are only indicative and should never 
dictate the action needed to address both individual risk and societal concerns. 





Modelling uncertainty - This concerns the validity of the way chosen to represent in 
mathematical terms, or in an analogue fashion, the process giving rise to the risks. An 
example is the growth of a crack in the wall of a pressure vessel. The model would 
postulate the way the growth rate is affected by factors such as the material properties and 
the stress history to which the vessel is exposed in service. The model will provide 
prediction of failure in terms of time and the nature of the failure. It will inform 
intervention strategies such as the material specification, in-service monitoring and 
mitigation measures. The rigour of the peer review process and openness to alternative 
hypotheses are the main safeguards. However, the most intractable problems arise when it 


is not practical or physically possible to subject the alternative hypotheses to rigorous 
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testing. In such cases, the exercise of expert judgement is paramount and confidence 


depends on the procedures adopted for selection of the experts and the elimination of bias. 


Limited predictability or unpredictability - There are limits to the predictability of 
phenomena when the outcomes are very sensitive to the assumed initial conditions. 
Systems that begin in the same nominal state do not end up in the same final state. Any 
inaccuracy in determining the actual initial state will limit our ability to predict the future 


and in some cases the system behaviour will become chaotic and unpredictable. 


82 However, our risk assessment and risk management procedures have a number of 
safeguards to ensure that our approach is in line with the Precautionary Principle, ie to rule out 
the lack of certainty as a reason for not taking preventive action. The Precautionary Principle 
describes the philosophy that should be adopted for addressing risks subject to high uncertainty, 
particularly in the environmental field. It is incorporated in EEC Treaty under Article 130r, and 
other international treaties and conventions concerned with ‘global’ environmental issues (eg 
climate change, ozone depletion). Though not defined in the EEC Treaty, the Precautionary 
Principle has been defined by the United Nations Conference on the Environment and 


Development (UNCED) in 1992 as: 
where there are threats of serious or irreversible environmental damage, lack of full 
scientific certainty shall not be used as a reason for postponing cost effective 
measures to prevent degradation.' 
83 Thus, as a rule, our risk assessment procedures: 
= require that assumptions to fill gaps in knowledge be tested through recognised 
methods, eg sensitivity analysis; 
= attach more weight to consequences for hazards giving rise to irreversible and 
potentially severe detriment, eg cancer; 
= give more weight to the consequences of a risk being realised than to its likelihood, 
the greater the uncertainty about the latter. For example, by assuming that working 
with genetically modified organisms entails a very high degree of risk and must 
therefore be subject to a very stringent control regime; 


= build safety factors in the assessment process where appropriate, eg in assessing toxic 


substances, safety factors are used depending on the quality of data, severity of effect, 
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and whether data from animals or in vitro experiments are being extrapolated to 


humans; 


= consider worst case scenarios, the greater the uncertainty about consequences. These 
can span from a 'most likely' worst case to a 'worst case possible' depending on the 
degree of uncertainty, societal concerns and, again, attributes such as irreversibility of 


realised consequences or potential for affecting future generations; 


= make use of comparative risk assessment for novel hazards that bear a similarity with 
existing hazards requiring a stringent control regime for reducing risks to tolerable 


levels. 


84 All the above show that assessing risks is far from being a straightforward exercise. At 
times the risk assessment will be a straightforward process based on observation and judgement, 
while at the other extreme it can also require the use of complex techniques such as quantified 
risk assessment. In practice it cannot be carried out without adopting certain conventions or 


protocols. We examine some of these at Annex 1. 


Stage 3 - Examining the options available and their merits 

Identifying options 

85 Once the problem has been characterised we then identify the options available for 
managing the risks. These can range from doing nothing to introducing measures (whether 
non-regulatory or regulatory) to get rid of the cause of the problem altogether, or to reduce it 
to one which people are prepared to live with, in the knowledge that further measures will 


continue to be sought to reduce the risks as low as reasonably practicable. 
86 The courses of action available are similarly many and varied, for example: 
= improving the available knowledge base through research; 


= providing more information and guidance to duty holders to enable them to fulfil their 


responsibilities; 


=" publicity campaigns to create awareness so that those exposed to risks can exert their 
influence, for example the 'Good Health is Good Business' campaign and the publicity 


given to the poor maintenance of domestic gas heating installations; 
= engaging the assistance of intermediaries in the health and safety system; 


" — stronger enforcement of existing legal provisions; 
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= exerting pressure for heavier penalties on transgressors; 


= developing the line to be taken in negotiation of European directives to reflect the 


issue as it manifests itself in Great Britain; 


= targeting action on those able to control the risks as distinct from imposing lowest 


common denominator provisions on all and sundry; and 


« in the final analysis, proposing new measures that are commensurate with the risks to 


be addressed, eg new law. 


87 For example, the following illustrates some of the options that are available for preventing 
or controlling exposure to a particular substance: banning the use of the substance altogether; 
requiring the use of technology for preventing the substance being released into the workplace 
or the environment; introducing licensing regimes to limit the number of people using the 
substance while ensuring that they use best practice to prevent accidental exposure to the 
substance; educating/informing the public on the steps they can take to prevent exposure (eg, on 
the need to service gas appliances to prevent carbon monoxide poisoning) or doing nothing 


because the substance does not pose a significant risk at the level at which it is present. 


88 We can often build on our experience of using the framework for identifying options that 
are likely to work in certain circumstances. For example we identify at Annex 2 the options that 
should be considered when introducing new regulations or guidance and the order in which they 


should be examined. 


89 In looking at options, we would be particularly interested in examining: 


# what constitutes good practice for addressing the hazards identified and evaluate its 
merits as an option. If good practice is not available we would also examine the 
merits of good practice that apply in comparable circumstances if we believe that this 


is directly transferable or can be modified for addressing the hazard; 


« possible constraints attached to a particular option; for example whether the option 
is technically feasible; or whether there are legal constraints on its adoption. As 
shown in Annex 2, we would wish to adhere to the general principle that the option 


adopted will improve or at least maintain standards of health, safety and welfare; 


= any adverse consequences associated with a particular option. Very often adopting 
an option for reducing one particular risk of concern may create or increase another 
type of risk. For example: banning a particular solvent may increase the use of a more 
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hazardous one; reducing airborne concentration of substances in the workplace by 
exhaust ventilation may increase risk in the community or vice versa. Therefore for 
each option having adverse consequences we examine the trade-off between reducing 
the target risk and the increase in other risks. Annex 3 gives an indication of how far 


and how deeply this exercise is carried out; 


how much uncertainty is attached to the issue under consideration and as a 
consequence the precautionary approach that should be adopted to ensure that 
decisions reached are in line with the Precautionary Principle (see paras 82-83). As 
we Shall see later, HSE adopts a framework (see para 110ff.) for reaching decisions 
which intrinsically ensures that while there is a bias towards health and safety to take 
account of uncertainty, this bias reflects a proper judgement of the degree of caution 
needed in the circumstances of the decision. The framework achieves this by ensuring 
that, as the degree of uncertainty increases, and depending on certain other 
characteristics attached to a particular hazard (eg whether the risk, if realised, could 
result in consequences that are irreversible or could detrimentally affect future 
generations), there is an increasing shift towards requiring more stringent measures to 
mitigate the risks. Moreover, in cases where the benefits cannot justify the risks, the 
framework requires that consideration is given to banning the entity or the process 


giving rise to the hazard; 


how far certain options should be constrained so that the problem remains within the 
boundaries that we have set in stage one. For example, when considering options for 
improving health and safety on the railways and in particular whether a railway 
operator should introduce investments, we would not consider the question whether 
the resources could be better spent on the National Health Service as this would be an 


issue for the Government to address; 


how far the options succeed in improving (or at least maintaining standards) in line 
with Section 1(2) of HSW Act. Though there is a duty on the HSC to adopt this 
principle when modernising legislation predating the HSW Act, the same principle 


permeates HSC/E's policies and approach to the regulation and management of risks; 


the costs and benefits attached to each option by looking at what is required to 


implement each option and the degree of risk reduction it is likely to achieve. Since 


this is one of the factors taken into account to inform decisions (the next stage in the 


process), it is examined in greater detail below. 


Assessment of Risk Reduction Action 

90 We sometimes need to carry out formal analyses of costs and risk reduction to help with 
judgements on the benefits of each option and the costs involved in reducing the risks. These 
analyses may be of varying sophistication and complexity, and might in some cases include a 
cost benefit analysis (CBA). CBA is often a useful tool for judging the balance between the 
benefits of each option and the costs incurred in implementing it. CBA aims to express all 
relevant costs and benefits in a common currency, usually money. This in principle requires the 
explicit valuation of the benefit of reducing the risk. However, such a valuation may not always 
be possible or practicable - in these circumstances we rely on quantitative or qualitative 
estimates. And, in any case, we apply common sense when reviewing the results. Moreover, 


explicit valuations may not always be necessary because: 


= as we shall see later, most safety provision for day to day hazards is in terms of the 
adoption of good practice or the voluntary pursuit of best practice, taking advantage 


of technological advances; and 


= it makes more sense to compare the difference in costs from switching from one 


option to another against the gains so achieved in terms of avoidance of harm. 


91 Nevertheless, we do carry out explicit valuations in support of policy proposals that would 
require duty holders to make major investments in safety measures, or when introducing new 


regulations. 


92 When an option produces the benefit of preventing fatalities, this requires putting a 
monetary value on achieving a reduction in the risk of death. For example, when conducting 
CBAs, we currently take as a benchmark that the value of a statistical life’? (VOSL) is about 
£902,500 (1998 prices). This figure derives from the value used by the Department of the 
Environment, Transport and the Regions for the appraisal of new road schemes. However, we 
would regard higher values as being appropriate for risks for which there is high aversion, eg 


those which give rise to high levels of societal concern or individual risk. 


93 There will of course be many options where potential benefits are not concerned with a 


reduction in the risk of death, for example avoiding deafness or dermatitis or a major injury. 


1S As is made clear in Annex 3, the value of a statistical life is not the value that society, or the courts, 
might put on the life of a real person or the compensation appropriate to its loss. 
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Adopting decisions - Setting occupational exposure limits 


Occupational exposure limits (OELs) are important risk management tools that regulate the 
extent of personal exposure (via inhalation) to substances hazardous to health. The 
procedures for setting OELs illustrate the involvement of the stakeholders in consensus 
decision making in an area where risk assessment is complex and where account has to be 
taken of uncertainty and socio-economic factors. The procedures also illustrate the use of 
dose as a necessary surrogate for risk and the importance of openness. 


Under the framework in the Control of Substances Hazardous to Health Regulations 
(COSHH), there are two types of OEL - an occupational exposure standard (OES) and a 
maximum exposure limit (MEL). Both are expressed as airborne concentrations of a 
hazardous substance averaged over a period of time. 


An OES is set at a level at which, based on current scientific knowledge, it is judged that 
there is minimal risk to the health of the workforce if exposed via inhalation to the substance 
day after day. MELs are normally set for substances which may cause health effects such as 
cancer or occupational asthma where it is not possible to identify reliably a threshold of 
exposure on which to base an OES. MELs are also set for substances for which "safe" 
thresholds may be identifiable, but control to these levels is not reasonably practicable. 


OESs and MELs are set on the recommendations of the HSC's Advisory Committee on 
Toxic Substances (ACTS) and its Working Group on the Assessment of Toxic Chemicals 
(WATCH). The role of WATCH is to consider all the scientific evidence; the role of ACTS 
is more to take into account socio-economic factors in balancing risks to health against the 
costs and effort of reducing exposure. Both groups comprise appropriate representatives of 
the stakeholders, e.g. employers and employees, together with independent experts. 


The process starts in WATCH which decides for each substance whether an OES can be 
established, and if so at what level it should be set, using assessment or uncertainty factors to 
reflect, e.g. the quality of the data, the nature of the toxic effect and the need to extrapolate 
from animal data to effects on people. If, however, WATCH decides that a MEL is 
appropriate, consideration of the level passes to ACTS. ACTS makes recommendations on 
the basis of the level that can be achieved by application of good occupational hygiene 
practice, taking into account socio-economic factors. (In practice WATCH or ACTS may 
recommend separate levels for 8 hour time-weighted average and 15 minute reference 
periods.) If the recommendations are endorsed by the Commission, proposals are published 
for public consultation, together with information for each substance on the toxic effects, 
typical exposure levels, measurement methods and the basis for the proposed exposure limit - 
including, for a MEL, a cost benefit assessment. 


After public consultation the Commission may approve a new OES or advise the Secretary of 
State that a new MEL should be added to Schedule 1 of the COSHH Regulations. 


Further information: 


Health and Safety Executive guidance booklets EH40, "Occupational Exposure Limits" and 
EH64, "Summary criteria for occupational exposure limits", both published annually. 


Fairhurst S., "The uncertainty factor in the setting of occupational exposure standards", 
Annals of Occ. Hygiene, Vol 39, p375-385, 1995. 
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Very often in these cases, we place monetary values on the risk reduction by comparing how 
society rates the risks of harms such as a major injury relative to the risk of death. In addition, 
there may be non-monetary benefits of a regulatory option such as improvement in the sense of 


well-being or security. 


94 Expected costs for an option may also be non-monetary as well as monetary. Typical 
examples of monetary costs include those associated with the development and application of 
technology, training, clean-up etc. Non-monetary costs include loss of things that people value, 
such as convenience or a reduction in choice for consumers and businesses, for example if a 


product or process is banned. 


95 We give further information on our approach for appraising options at Annex 3, including 
the use of the results of CBA for assessing the cost-effectiveness of the options identified. 
However, as will be clear from the next stage, cost-benefit analysis is only one of a number of 


factors that are taken into account in deciding whether to pursue any particular course of action. 


96 Eventually we reach a point where we have to make a judgement about whether enough 
information has been collected and analysed to enable us to proceed to the next stage. This 
avoids us falling into a mode known as "paralysis by analysis" where the need for additional 


information is used as an excuse to avoid or postpone the adoption of a decision. 


Stage 4 - Adopting decisions 

97 This is the stage where we review all the information gathered in the previous stage with a 
view to selecting the most appropriate option for managing the risks. The key to success 
depends to a large extent on ensuring as far as possible that interested parties are content with 
the process for reaching decisions and, hopefully, also with the decisions themselves. They will 


have to be satisfied, for example, about: 
i) the way uncertainty has been addressed, the plausibility of the assumptions made; and 
li) how other relevant factors such as economic, technological and_ political 


considerations have been integrated in the decision-making process. 


98 Meeting these conditions is not always easy to achieve, particularly when parties have 
opposing opinions based on differences in fundamental values or confine themselves to a single 


issue. Nevertheless, we tackle the first condition by: 


« finding out and focusing on the uncertainties that matter; 
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# explaining why a particular method was chosen, in preference to others, for estimating 


the risks; and finally 


# by being open on the science, assumptions and other critical inputs that have 


contributed to the estimate or judgement used for obtaining the risk estimate. 


The importance of societal concerns - adventure activities 


The regulatory controls recently put in place on certain adventure activities (eg 
caving, watersport or climbing activities) show how societal factors can 
sometimes dominate considerations of individual risk and cost benefit. 


In 1993, four young people lost their lives in a canoeing tragedy at Lyme Bay. 
At the request of Ministers, the Health and Safety Commission published a 
consultative document (CD) seeking views on proposed new regulations to 
licence certain providers of certain adventure activities. The proposed controls 
took the form of a statutory licensing system even though (as the CD noted): 


¢ the historic risk of fatalities was low; 


¢ formal licensing systems are normally reserved for activities which, if not 
properly managed, would pose high risks to large numbers of people (eg 
manufacture and storage of explosives, operation of nuclear installations, or 


certain work with asbestos); and 


a cost benefit assessment showed that resources required for introducing the 
licensing system could be used more profitably elsewhere to achieve greater 
improvements in health and safety. 


Public consultation confirmed the desire for new controls along the lines 
proposed - a reflection of societal concerns. Such concerns might perhaps be 
summarised in the view that society expects a very high standard of care by 
organisations which provide activities that aim to develop young people by 
enabling them to experience a sense of achievement in overcoming challenges 
they would not otherwise meet. 


The Adventure Activities Licensing Regulations came into force in April 1996. 


Note: Although made under "The Activity Centres (Young Persons' Safety) 
Act 1995", the requirements of the 1996 Regulations are enforceable as if they 
were relevant statutory provisions under the Health and Safety at Work etc. Act 
1974, and the licensing authority has to report annually to the Health and Safety 
Commission. 





99 Addressing the second condition above (ie how economic, technological and political 
considerations have been integrated in the decision-making process) is more difficult. Success 
lies in adopting decisions which most accurately reflect the ethical and value preferences of 
society at large on what risks are unacceptable, tolerable or broadly acceptable, and how far we 


have been successful in involving stakeholders in the decision-making process. At times, to take 
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account of uncertainty and the need to adopt a precautionary approach, this might require 
focusing more on the consequences of harm occurring from a hazard than on the likelihood that 


the hazard will be realised (see paras 36-41). 


100 We shall examine in more detail later how the criteria that we have developed on the 


tolerability of risks address these issues. 


Stage 5 - Implementing the decisions 

101 When we have reached a decision on the degree to which a risk should be controlled, we 
have to decide how the decision can be implemented in practice using the regulatory tools at 
our disposal, eg recommending new legislation, inviting new guidance or taking enforcement 
action. As explained in paras 5-6, the responsibility for measures for controlling a risk will 
usually fall on the person who creates it or who is in a position to do something about 


preventing or minimising it. 


102 Whatever the regulatory tool we apply, our approach is to use it to encourage those who 


have to introduce measures to manage risks to: 


# enlist the co-operation and involvement of those affected, by pointing out for 
example, that employers are unlikely to be able to control risks in their workplace 


without the help of their employees; 


= introduce procedures that foster a culture disposing everyone involved to give of their 
best. For example, in the workplace this may mean getting a commitment, at every 
level of the organisation, to adopt high health and safety standards and work to them. 
It also calls for the establishment of well-considered and articulated safety policies 
where responsibilities are properly defined and allocated and organisational 
arrangements set out to ensure control and promote co-operation, communication and 


competence; 


= have a plan for taking action by looking ahead and setting priorities for ensuring that 
risks requiring most attention are tackled first, based on the risk assessment which 
they are legally required to undertake under the Management of Health and Safety at 
Work Regulations and other specific legislation; 


= set up a system for monitoring and evaluating progress; eg by identifying potential 
indicators for evaluating how far the control measures introduced have been 


successful in addressing the problem; 
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= comply with well-established principles on the hierarchy of measures for the 
prevention of risks, eg eliminating risks, combating the risk at source, applying 
collective protective measures rather than individual protective measures and 


generally applying sound engineering practice such as inherently safer design. 
103 We give further details on these aspects of our approach in a number of our publications”. 


Stage 6 - Evaluating the effectiveness of action taken 
104 Finally, our process for ensuring that risks are properly managed would not be complete 


without ex post procedures to establish: 


«= whether the actions taken to ensure that the risks are adequately controlled resulted in 


what was intended; 


= whether decisions previously reached need to be modified and, if so, how; for 
example, because what was considered at the time to be good practice may no longer 
be regarded as such as a result of new knowledge, advances in technology or changes 


in the level of societal concerns; 


= how appropriate was the information gathered in the first two stages of the decision- 
making process to assist decisions for action, eg the methodologies used for the risk 


assessment and the cost benefit analysis (if prepared), or the assumptions made; 
= whether improved knowledge and data would have helped to reach better decisions; 


# what lessons could be learned to guide future regulatory decisions, improve the 
decision-making process and create greater trust between regulators and those 


affected by, or having an interest in, the risk problem. 


105 We regard such evaluations as an ongoing process which we need to plan carefully to 
ensure, for example, that we can tap the data that we have encouraged risk managers to obtain 
by suggesting they set up a system for monitoring and evaluating progress (para 102 above). 
Since there might be some time before the full impact of risk reduction measures can be 
monitored, we might first focus on our success in getting risk managers to introduce 


appropriate measures before concentrating on the success of the decisions'as a whole. 


16 


Health and Safety Executive, "Successful Health and Safety Management", HSG65, ISBN 
0-7176-1276-7, HSE Books, PO Box 1999, Sudbury, Suffolk CO10 6FS, 1997. 


Health and Safety Executive, "5 Steps to Risk Assessment", INDG 163, HSE books. 


Health and Safety Executive, "Management of Health and Safety at Work. Management of Health 
and Safety at Work Regulations 1992. Approved Code of Practice, L21, ISBN 0-7176 0412-8, 1992. 
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106 The importance of the evaluation. stage should not be underestimated. For example, we 
shall see later that the criteria that we adopt for deciding the degree to which risk should be 
controlled rely heavily on good practice being adopted. Evaluation provides a good 
opportunity to assess whether ‘established good practice’ is out of date. New developments 
such as better knowledge of the risks involved and advances in technology may indicate that a 


higher (or lower) standard would be more appropriate to control the risk. 


Criteria for reaching decisions 

107 Though all six stages of the decision management system just described are important, 
getting stage 4 right (the one concerned with reaching decisions) is crucial. Achieving this will 
not only help to reach decisions that are likely to be supported and implemented but, because of 
the iterative process inherent in the health and safety management system, it will also help to get 
the other stages right as well. Getting it right depends to a large extent on the criteria adopted 
for deciding whether a risk is unacceptable, tolerable or broadly acceptable. It is, therefore, not 


surprising that a lot of effort has been spent in developing such criteria. 


108 Research has shown that the criteria used by regulators in the health, safety and 
environmental field can be classified according to three ‘pure’ criteria; regulators have either 
used these 'pure' criteria on their own or have used them as building blocks to create new 


criteria. They are: 


= an equity-based criterion, which starts with the premise that all individuals have 
unconditional rights to certain levels of protection. This leads to standards, applicable 
to all, held to be usually acceptable in normal life, or which refer to some other 
premise held to establish an expectation of protection. In practice, this often converts 
into fixing a limit to represent the maximum level of risk above which no individual 
can be exposed. If the risk estimate derived from the risk assessment is above the 
limit and further control measures cannot be introduced to reduce the risk, the risk is 


held to be unacceptable whatever the benefits; 


= a utility-based criterion which applies to the comparison between the incremental 
benefits of the measures to prevent the risk of injury or detriment, and the cost of the 
measures. In other words, the utility based criterion compares in monetary terms the 
relevant benefits (eg statistical lives saved, life-years extended) obtained by the 


adoption of a particular risk prevention measure with the net cost of introducing it, 
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and requires that a particular balance be struck between the two. This balance can be 
deliberately skewed towards benefits by ensuring that there is gross disproportion 


between the costs and the benefits; 


# a 'technology-based' criterion which essentially reflects the idea that a satisfactory 
level of risk prevention is attained when "state of the art" technology is employed to 


control risks whatever the circumstances. 


New technology 


HSC/E seek to harness technological developments to improve standards of 
health and safety, particularly where the consequences of an accident are high. 


For railway safety, for example, HSC recently published a consultative 
document inviting comments on proposed new regulations that, taking account 
of developments in technology and cost benefit considerations, and subject to 
transitional arrangements, would: 


(a) reduce significantly the risks of an accident at key locations throughout the 
rail network by requiring the provision of suitable train protection systems that 
would automatically apply the brakes if a train passed a stop signal, or travelled 
at excessive speed approaching a stop signal or part of a railway where there 
was a Speed restriction; and 


(b) mitigate the consequences of an accident by prohibiting, after a set date, the 
use of Mark 1 rolling stock (which is known to have a relatively poor level of 
crashworthiness and door safety in comparison with later designs) unless 
rebodied to provide a similar standard of safety as new stock. 


The consultative document noted, for example, that presently only a small 
proportion of Britain's railway system is covered by modern, technically 
advanced train protection systems, which are much more effective in preventing 
collisions than the basic automatic warning system first introduced 60 years 
ago. The document made clear that, in HSC/E's view, further safety 
improvements were now needed. 


Following consultation, HSC proposed to Ministers that the measures 
summarised in (a) and (b) above should have the force of law. New 
Regulations, The Railway Safety Regulations, are due to enter the statute book 
in the Spring of 1999. 





109 Though there are many circumstances where these criteria work well on their own, their 


universal application has been found wanting. For example, it has been argued that: 


= —_an equity-based criterion may often, in practice, require taking decisions on worst case 
scenarios bearing little resemblance to reality. In such cases, the decisions reached are 


inevitably based on procedures which systematically overestimate risks, causing undue 
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alarm and despondency among the public or resulting in benefits achieved at 


disproportionate costs; 


*  autility-based criterion tends to ignore that there are other ethical considerations than 
just achieving a balance between costs and benefits. For example, some people 
believe that certain hazards should not be entertained at all, no matter how low the 
risks, because they are morally unacceptable. At the other extreme, utility-based 
criteria do not impose an upper bound on risk, whereas we believe that there are risks 
that society regards as unacceptable because they entail too high a likelihood that 


harm will actually occur to those exposed; 


# technology-based criteria would, for example, require wood furniture manufacturers 
to adopt the state-of-the-art technology developed for keeping clinically clean, 


factories manufacturing electronic chips - hardly a realistic proposition. 


110 However, as already mentioned above, there is of course no reason why the above three 
pure criteria should be regarded as mutually exclusive. Indeed, the criteria that HSE has 
adopted in the form of a framework, known as the tolerability of risk (TOR), accommodate all 


three criteria. The strength of the framework lies in: 


# its ability to capitalise on the advantages of each of the above ‘pure criteria’ whilst 


avoiding their disadvantages; and 


= the fact that the main tests that are applied under it for reaching decisions on what 
action needs to be taken are very similar to those people apply in everyday life. As 
already mentioned, in everyday life there are some risks that people choose to ignore 
and others that they are not prepared to entertain. But there are also many risks that 
people are prepared to take by operating a trade-off between the benefits of taking the 


risks and the precautions we all have to take to mitigate their undesirable effects. 


111 The framework is illustrated in Figure 1. The triangle represents increasing level of ‘risk’ 
(measured by the individual risk and societal concerns they engender) as we move from the 
bottom of the triangle towards the top. The dark zone at the top represents an unacceptable 
region. For practical purposes, a particular risk falling into that region is regarded as 
unacceptable whatever the benefits. Any activity or practice giving rise to risks falling in that 
region would be ruled out unless the activity or practice can be modified to reduce the degree of 


risk so that it falls in one of the regions below. 
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Unacceptable 
region ao) 
Risk cannot be justified save in 
extraordinary circumstances 


Control measures must be 
introduced for risk in this region 
to drive residual risk towards the 
broadly acceptable region 


Tolerable 
Region If residual risk remains in this 
region, and society desires the 
benefit of the activity, the 
residual risk is tolerable only if 
further risk reduction’ is 
impracticable or requires action 
that is grossly disproportionate in 
time, trouble and effort to the 
reduction in risk achieved 





Broadly acceptable 
region Level of residual risk regarded as 
insignificant and further effort to 
reduce risk not likely to be 
required as resources to reduce 
risks likely to be _ grossly 
disproportionate to the mnsk 
reduction achieved 


Increasing Individual risks and societal concerns 


Negligible risk 


Figure 1. HSE criteria for the tolerability of risk 


N.B. The meaning of ‘risk’ in the above figure encompasses more than physical harm and 


also takes account of other factors such as ethical and social considerations (see paras 
20-26). 
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112 The light zone at the bottom, on the other hand, represents a broadly acceptable region. 
Risks falling into this region are regarded as insignificant and adequately controlled. Further 
action to reduce risks will not usually be required unless evidently reasonably practicable 
measures are available. The levels of risk characterising this region are comparable to those that 
people regard as insignificant or trivial in their daily lives. They are typical of the risk from 
activities that are inherently not very hazardous or from hazardous activities that are so well 
controlled that risk control measures are at the limit of practicability. Further resources 
involved for reducing risks will usually be grossly disproportionate to the risk reduction 
achieved. Nonetheless, if it is possible to reduce the risks at minimal costs, such action would 


be warranted. 


113. The zone between the unacceptable and broadly acceptable regions is the tolerable region. 
Risks in that region are typical of the risks from activities that people are prepared to tolerate in 


order to secure benefits, in the expectation that: 


= the nature and level of the risks are properly assessed and the results made available. 
The assessment of the risks needs to be based on the best available scientific evidence 


and, where evidence is lacking, on the best available scientific advice; 


# the risks are not unduly high and kept as low as reasonably practicable (the ALARP 
principle - see Annex 3); and 


= the risks are periodically reviewed to ensure that they still meet the ALARP criteria, 
for example, by ascertaining whether further or new control measures need to be 
introduced to take into account changes over time, such as new knowledge about the 


risk or the availability of new techniques for reducing or eliminating risks. 


114 Benefits for which people generally tolerate risks typically include employment, lower cost 
of production, personal convenience or the maintenance of general social infrastructure such as 


the production of electricity or the maintenance of food or water supplies. 


115 As such the framework can be seen as essentially applying an equity-based criterion for 
risks falling in the upper region, while a utility-based criterion predominates for risks falling in 
the middle and lower regions and technology-based criteria complement the other criteria in all 


three regions. 


116 It must be stressed that Figure 1 is a conceptual model. The protocols, procedures and 
criteria described in this document should ensure that in practice, risks are controlled to such a 
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degree that the residual risk remaining is driven down the tolerable range so that it falls either in 
the tolerable region or is near the bottom of the tolerable region, in keeping with the duty to 


ensure health, safety and welfare so far as is reasonable practicable. 


Tolerability Limits 

117 When addressing any particular hazard, whether the option we have chosen to control the 
risk ALARP is good enough or not depends a lot on where the boundaries lie between the 
unacceptable, tolerable or broadly acceptable regions in Figure 1. As will be clear from earlier 
discussions, the choice will be the outcome of much deliberation and negotiation in the course 
of policy development, reflecting the value preferences of stakeholders and the practicability of 
possible solutions. As a result what is unacceptable, tolerable or broadly acceptable in specific 
circumstances is often spelled out or implied in legislation, ACoPs, guidance, etc or reflected in 
what constitutes good practice. However, HSE on the basis of its wealth of experience 
accumulated over the years in dealing with its stakeholders subscribes as a matter of policy to 
the following indicative criteria, as to where these boundaries lie, for risks in a limited 
category, namely those entailing the risk of death either individually or in multiple. We must 
also stress that these criteria are merely guidelines to be interpreted with commonsense and are 
not intended to be rigid benchmarks to be complied with in all circumstances. They may, for 


example, need to be adapted to take account of societal concerns or preferences. 


Boundary between the ‘broadly acceptable’ and 'tolerable' regions for risk entailing fatalities 

118 HSE believes that an individual risk of death of one in a million per annum for both 
workers and the public corresponds to a very low level of risk and should be used as a guideline 
for the boundary between the broadly acceptable and tolerable regions. As is very apparent 
from Tables 1-5 at Annex 4, wé live in an environment of appreciable risks of various kinds 
which contribute to what we call the background level of risk - typically a risk of death of one in 
a hundred per year averaged over a lifetime. A residual risk of one in a million per year is 
extremely small when compared to this background level of risk. Indeed many activities which 
people are prepared to accept in their daily lives for the benefits they bring entail or exceed such 


levels of residual risks, for example, using gas and electricity, or engaging in air travel. 


119 Moreover, many of the activities entailing such a low level of residual risk also bring 

benefits that contribute to lowering the background level of risks. For example, though 

electricity kills a number of people every year and entails an individual risk of death in the 

region of one in a million per annum, it also saves many more lives, eg by providing homes with 
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Occupational exposure limits for substances hazardous to health and the TOR 
framework 


In a previous example we explained that occupational exposure limits (OELs) determine the 
extent of exposure (by inhalation) of people at work to substances hazardous to health; an 
OEL can be of two types - an occupational exposure standard (OES) or a maximum 
exposure limit (MEL). 


In principle an OEL ought to be set using data on all the effects on health produced by the 
substance at different levels of occupational exposure. In practice, however, absence of 
data and lack of a clear understanding of the biological processes involved mean it can be 
difficult to relate occupational exposure over time to a probability of specific harm, 
particularly for chronic effects such as cancer, occupational asthma or dermatitis. (One 
exception is chrysotile asbestos, for which the relationship between the risk of death from 
lung cancer and occupational exposure has been estimated.) Alternative approaches are, 
therefore, normally adopted (see below). Nevertheless, the general TOR framework 
(Figure 1) still applies, and illustrates the application of the different types of OEL, the role 
of legislation in sometimes setting out what is intolerable, and the use of good practice in 
setting limits. 


The conventional approach is to decide whether or not the hazardous properties of the 
substance have a threshold, and if so to seek to derive from the available data an overall no 
Observed adverse effect level (NOAEL). Using suitable assessment or uncertainty factors 
(see Box on page 36) the NOAEL is then translated into an OES - a level of exposure at 
which, based on current scientific knowledge, it is judged that there is minimal risk to the 
health of the workforce. An OES is, however, only set if the level can be met by the 
application of good practice, and foreseeable excursions above this level are not associated 
with serious health effects. 


In contrast, MELs are normally set for substances for which it is judged that there is no 
identifiable threshold of exposure and the health effects produced are of serious concern. 
(A MEL may also be set for substances for which it may be possible to identify a 
“no-effect" level, but control to the corresponding exposure level is not reasonably 
practicable.) A MEL is set at the level which is reasonably practicable to achieve for the 
work activity where control of exposure is most difficult. 


Under the Control of Substances Hazardous to Health Regulations (COSHH), exposure 
must not exceed the MEL and must be reduced to a level which is as low as is reasonably 
practicable below the MEL in accordance with good practice. In effect, MELs are at the 
boundary between the unacceptable and tolerable regions of exposure (Figure 1); exposure 
above the MEL is deemed intolerable. 


On the other hand, control of exposure to an OES represents a level of risk that is close to 
or even within the broadly acceptable region. The permitted excursions are in the tolerable 
region provided exposure is restored to the OES as soon as is reasonable practicable (as 
required by COSHH). 


However, whilst MELs and OESs fit within the framework of Figure 1, the levels at which 
they are set do not correspond with the numerical limits of risk in paras 118-121 (OELs 
are, of course, set substance by substance; they do not usually relate to end points of death; 
and they are not expressed in terms of probability of harm). 
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light and heat, operating lifts, life support machines and through a myriad of other uses. Indeed, 
it is the combined effect of many activities involving such low level of residual risks that 


contributes to the wealth of the nation and leads to improvements in health and longevity. 


Boundary between the ‘tolerable’ and 'unacceptable' regions for risk entailing fatalities 

120 We do not have, for this boundary, a criterion for individual risk as widely applicable as 
the one mentioned above for the boundary between the broadly acceptable and tolerable 
regions. This is because risks may be unacceptable on grounds of a high level of risk to an 
exposed individual or to the repercussions of an activity or event on wider society. Indeed, it 
would be quite unusual for high levels of individual risk not to engender societal concerns, on 
equity grounds, for example, as we have already argued. The converse is not, however, true - 
society can be seized by risks that pose, on average, quite low levels of risk to any individual 
but could impact unfairly on vulnerable groups, such as the young, or the elderly or particularly 
susceptible individuals. Furtherrnore, exposure to an activity may result in a low level of 
average risk to any one individual but the totality of such risks across the affected population 
would not be acceptable as judged by the socio-political response to a particular event such as a 
railway disaster. Nevertheless, in our document on the tolerability of risks in nuclear power 
stations, we suggested that an individual risk of death of one in a thousand per annum should on 
its own represent the dividing line between what could be just tolerable'’ for any substantial 
category of workers for any large part of a working life, and what is unacceptable for any but 
fairly exceptional groups. For members of the public who have a risk imposed on them “in the 
wider interest of society” this limit is judged to be an order of magnitude lower - at one in ten 


thousand per annum. 


121 However, these limits rarely bite. As we have already pointed out, hazards that give rise 
to such levels of individual risks also give rise to societal concerns and the latter often play a far 
greater role in deciding whether a risk is unacceptable or not. Secondly, these limits were 
derived for activities most difficult to control and reflect agreements reached at international 


level. In practice most industries in the UK do much better than that. 


Risks giving rise to societal concerns 
122 Developing criteria on tolerability of risks for hazards giving rise to societal concerns is 


difficult. Hazards giving rise to such concerns often involve a wide range of events with a range 





'’ Provided of course that all steps have already been taken to reduce the risks as far as reasonably 


practicable as explained above. 
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Tolerability Limits for Risks entailing Fatalities 


In practice, the actual fatality rate for workers in even the most hazardous industries is 
normally well below the upper limit of a risk of death to any individual of 1 in 1000 per 
annum for workers and of 1 in 10,000 per annum for the public who have a risk imposed 
on them "in the wider interest of society" (paras 118-120). 


For example, for commercial diving, the annual fatality rate has been estimated at 1 in 
2,700 based on the number of fatalities over the last 7 years. Similarly the rate in 1995/96 
for mining and quarrying (including offshore oil and gas) was 1 in 4405. For agriculture, 
hunting, forestry and fishing (but not sea fishing) and for construction, the fatality rates in 
1995/96 were 1 in 12,500 and 1 in 20,000 respectively. In traditionally less hazardous 
industries the annual risk of death for workers is lower still; for example in the service 
sector in 1995/96 it was 1 in 242,000. 


Similarly, the actual risk of death per annum for the public from work activities is usually 
very much lower than the figure of 1 in 10,000. For example, in 1995/96 the risk of death 
to the public from the use of gas (fire, explosion or carbon monoxide poisoning), averaged 
over the entire population, was 1 in 1,350,000 - in other words below the limit of what is 
often regarded as broadly acceptable. Gas incidents, however, continue to give rise to 
societal concern, particularly where the incidents occur because unscrupulous landlords seek 
to avoid the cost of simple safety checks on their gas heating systems and so put those who 
rent the accommodation (often young people) at greater risk. In effect, such societal 
concerns override averaged numerical considerations. HSE has responded by firm 
enforcement action where appropriate, and by targeted publicity emphasising the importance 
of annual safety checks on gas appliances. 


Further Information: 
Annex 4 gives other examples of the magnitude of different risks. 


Further information is available in Health and Safety Statistics 1996/97 published by the 
Health and Safety Commission. 





of possible outcomes. The summing or integration of such risks, or their mutual comparison, 
may call for the attribution of weighting factors for which, at present, no generally agreed 
values exist as, for example, the death of a child as opposed to an elderly person, dying from a 


dreaded cause, eg cancer, or the fear of affecting future generations in an irreversible way. 


123 Nevertheless, HSE has adopted the criteria below (some of which are currently under 
review). These were based on an examination of the levels of risk that society was prepared to 
tolerate from a major accident affecting the population surrounding the industrial installations at 
Canvey Island on the Thames. Reports on the risk from the installations at Canvey Island were 
discussed in Parliament, and (after improvements) the risk was deemed by Ministers to be just 
tolerable. The limit was subsequently endorsed by the HSC's Advisory Committee on 


Dangerous Substances in the context of major hazards transport’*. Such criteria were 


'8 HSC, Advisory Committee on Dangerous Substances, Major hazard aspects of the transport of 


dangerous substances, 1991, ISBN 0 11 885676 6. 
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developed through the use of so-called FN-curves (obtained by plotting the frequency at which 
such events might kill N or more people, against N). These were found to provide a useful 
means of comparing the impact profiles of man-made accidents with the equivalent profiles for 
natural disasters with which society has to live. The method is not without its drawbacks but in 
the absence of little else it has proved a helpful tool if used sensibly'’. These criteria are, 
however, directly applicable only to risks from major industrial installations and may not be 
valid for very different types of risk such as flooding from a burst dam or crushing from crowds 


in sports stadia. 


124 Thus, where societal concerns arise because of the risk of multiple fatalities occurring in 
one event from a single major industrial activity’, HSE proposes the following basic criterion 
for the limit of tolerability, particularly for accidents where there is some choice whether to 
accept the hazard or not, eg the risk of such an event happening from a major chemical site or 
complex continuing to operate next to a housing estate. In such circumstances, HSE proposes 
that the risk of an accident causing the death of fifty people or more in a single event should be 


less than one in five thousand per annum. 


125 A different situation arises altogether when giving advice to planning authorities in 
connection with proposed developments in the vicinity of major hazard chemical plants. Since 
the developments have not yet received planning permission, not allowing them because of the 
putative societal risks to which would-be occupants would have been exposed by living next to 
a chemical plant, is relatively inexpensive when compared to the costs entailed in requiring 
existing developments with similar risks to introduce remedial measures. HSE's criteria for 
advising against a development because of the societal risks that it may engender are based in 
the first instance on the level of individual risk per year calculated for a hypothetical person (see 
Annex 1) receiving a dangerous dose, or worse, together with certain characteristics of the 


development. 


126 Thus in the case of most housing developments, for example, HSE advises against granting 
planning permission for any significant development where individual risk for the hypothetical 


person is more than 10 in a million per year, and does not advise against granting planning 
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For a review of the merits and disadvantages of FN curves - see Ball D. J. and Floyd P J (1998), 
Societal risks. Report available from the Risk Assessment Policy Unit, HSE. 

*° Here a single major industrial activity means an industrial activity from which risk is 
assessed as a whole, such as all chemical manufacturing and storage units within the control of 
one company in one location or within a site boundary, a cross-country pipeline, or a railway 
line along which dangerous goods are transported. 
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Example of good practice enshrined in law 


Substances hazardous to health and genetically modified micro-organisms 


Some basic principles of good occupational hygiene practice are enshrined in the Control of 
Substances Hazardous to Health Regulations 1994 (COSHH). Control of exposure to 
substances hazardous to health, for example, must be achieved by 


¢ prevention (e.g. by avoiding use altogether, or by substituting a less hazardous 
substance), or where this is not reasonably practicable by 


¢ control measures (e.g. engineering controls such as containment or local exhaust 
ventilation), or where this is not reasonably practicable by 


* personal protective equipment. 


Sometimes application of good practice is made a specific requirement in law. For example, 
in setting down standards of human health and environmental safety, the Genetically 
Modified Organisms (Contained Use) Regulations 1992! require application of “the 
principles of good microbiological practice and the following principles of good 
occupational safety and hygiene" (six well-accepted principles are then listed). Societal 
concerns over the risks from genetically modified micro-organisms are reflected in a high 
standard of control and, in the developing area of microbiological safety, a legal 
requirement which demands application of accepted good practice in step with evolving 
scientific knowledge and technological developments. 


1 These Regulations implement Directive 90/219/EEC on the contained use of genetically 
modified micro-organisms, which includes the same wording. 





permission on safety grounds for developments where such individual risk is less than 1 in a 
million per year. (Somewhat different criteria are applied to sensitive developments where 
those exposed to the risk are more vulnerable, eg schools, hospitals or old people's homes, or to 
industrial or leisure developments, reflecting the different characteristics of the hypothetical 


person used to assess individual risk). 


127 Cases of proposed housing development where the individual risk is between 1 and 10 ina 
million per year are scrutinised more closely, taking into account a more detailed assessment of 
the individual risk, the area of the development, the number of people involved, their 
vulnerability and how long they are exposed to the risk. Further information is available on the 
risk criteria presently applied by HSE in land use planning, including the criteria applied for 
different categories of development, for developments in the vicinity of major chemical plants, 


and for development of new plants”’. 
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Risk criteria for land use planning in the vicinity of major industrial hazards, HMSO, London ISBN 
0 11 885491 7. (Under review). 
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Applying the (generalised) TOR framework 

128 When we apply the framework to policy formulation, regulatory development and 
enforcement activities, we start with the expectation that duty holders have in place suitable 
controls to address all significant hazards arising from their undertakings, and that those 
controls implement authoritative good practice precautions, irrespective of site-based risk 


estimates. In this context we would: 


i) regard a hazard as significant unless: 


= informed common-sense, or going through the decision making process described 
earlier, shows the risk from it to be extremely low or negligible when compared 
to the background level of risk to which people are exposed and the hazard does 


not give rise to societal concerns; or 


= the risks that the hazard gives rise to are outside the control of the duty holder 


(see Annex 3). 


li) accept as authoritative sources of relevant good practice those enshrined in 
prescriptive legislation, Approved Codes of Practice and guidance produced by 
Government. We would also consider including as other sources of good practice, 
standards produced by Standards-making organisations (eg BS, CEN, CENELEC, 
ISO, IEC, ICRP) and guidance agreed by a body representing an industrial or 
occupational sector (eg trade federation, professional institution, sports governing 
body) provided the guidance had gained general acceptance in the safety movement 


that it does represent good practice. 


129 The next stage is to distil from the information gathered at stages 2 (characterising the 
problem) and 3 (examining options and their merits) on individual risks and societal concerns 
and, by applying the tests at Annex 3 and the criteria in paras 110-127 above, decide whether 
adoption of authoritative good practice precautions is an adequate response to the hazards. Our 
experience suggests that in most cases adopting good practice ensures that the risks are 
effectively controlled. This is because authoritative good practice represents a consensus 
between regulators, technical experts, duty holders, safety representatives etc. as to the action 
necessary (taking account of what is technically feasible, the balance of costs and benefits and, if 
necessary, other relevant factors such as the need to alleviate societal concerns) and usually 


results in a tolerable level of residual risk. 


a2 


130 One consequence of linking the control regime necessary to authoritative good practice is 
that the control measures so derived apply regardless of the length of exposure. For example, if 
good practice requires that accidental contact with the moving parts of a machine should be 
prevented through the fitting of a guard, the guard will need to be in place, however short the 


period the machine is being used. 


131 There will be, however, cases where good practice: 


« was not identified as an option in our identification of options at stage 3. This will be 
particularly true for hazards that are new or not well studied, or where the 


circumstances in which people interface with the hazard are untypical or exceptional; 


# is found to result in inadequate control of risks. 


132 In these circumstances we have to examine (again by adopting the procedure described at 
para 56 above) whether any of the other options identified at stages 2 and 3 would reduce the 


risks ALARP. If one is found we would advocate its adoption. 


133 However, as we go through this iterative process of examining options, there will be 
occasions when we may find that no option is available for reducing the risks ALARP. This will 


be the case for risks from activities: 


1) that are so high and their control inherently so difficult that it is not possible to find 


any control measures that one could feel confident would work in practice; or 


li) where it is not possible to allay the societal concerns about the risk. For example, 
though experts may regard available control measures as adequate for controlling a 
particular risk, that view may not be shared by society as a whole, as established 
through existing democratic processes and regulatory mechanisms, either because the 
majority of people believe that the measures will not always be observed or that they 


have doubts that the risks should be entertained at all. 


134 We would conclude in such circumstances that we are dealing with risks located in the 
upper, ‘unacceptable’ region of the framework. In our experience, activities or processes where 
the above conditions apply are relatively rare. There may be several reasons for this. First, as 
noted above, advances in technology mean that most risks can now be controlled. Secondly, we 
are aware that as regulators we can often allay societal concerns by giving reassurance that risks 


are being properly controlled through the introduction of progressively more stringent 
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Intolerable risks - I 


There are relatively few examples in health and safety legislation of processes or activities 
that have been banned because the risk they entail are so high and their control inherently 
so difficult that it is not possible to find any control measure that one could feel confident 
would work in practice (para 133(i)). 


The examples below are historical and reflect judgements on the risks from two 
particularly hazardous substances. The bans, however, have been continued into modern 
legislation because the risks are still real and, notwithstanding modern control measures, 
the judgement of the Health and Safety Commission (confirmed in public consultation) 
remains that, in the light of accepted good practice in using alternatives, the effort 
required to control the risk would be disproportionate. 


1) The manufacture and use-for any purpose of 2-naphthylamine and its salts were banned 
under the Carcinogenic Substances Regulations 1967 because its combination of physical 
(sublimation) and chemical (potent carcinogen) properties means that control of exposure 
is very difficult and the potential ill-health effects severe. The ban was continued under an 
EC Directive now implemented by the Control of Substances Hazardous to Health 
Regulations 1994 (COSHH). 


2) The Control of Lead at Work Regulations 1998 (CLAW) continue a prohibition on the 
use of certain glazes in pottery manufacture first introduced more than 40 years ago. The 
requirement bans any glaze unless it is ‘leadless' or ‘low solubility’ (terms which are 
defined). 


Historically, the use in pottery manufacture of glazes containing raw lead compounds 
resulted in unacceptably high levels of lead poisoning. The problem was resolved by the 
development of glazes containing reduced amounts of lead, or by ‘fritting' the lead 
compounds (i.e. fusing and quenching to form a glass, and then granulating) to produce 
glazes with much reduced lead bioavailability. Adoption of these glazes became accepted 
good practice and their use was made a legal requirement. 


Levels of exposure of workers to lead in the pottery industry are now relatively low and 
there are very few cases where workers have to be suspended from work with lead 
because their blood lead levels are above prescribed limits. 





regulatory instruments, such as the use of guidance, ACoPs, or prescriptive legislation, 
culminating if necessary in the introduction of process regulations such as notification or 


licensing systems (see Annex 2). 


135 Nevertheless, in situations where (i) or (ii) above are found to apply, we shall give 
consideration to banning these activities or processes. For existing risks where banning would 
be an incomplete solution because the hazard is already widespread, remedial action of some 


kind has to be undertaken - removal of blue asbestos prior to demolition of buildings is a case in 


point. 


Intolerable risks - II 


Presently there are very few examples in health and safety at work legislation of processes 
Or activities that have been banned outright on the basis of societal concerns (para 133(ii)). 
One concerns the employment of young people (under 18 years) in certain long-standing 
work activities where there is potential for exposure to high levels of lead. 


The Control of Lead at Work Regulations 1998 (CLAW) rationalise and continue certain 
historical restrictions on the employment of young persons and women of reproductive 
Capacity in specific activities where there is potential for high exposure to lead. 
Historically these restrictions were imposed mainly on the basis of ethical considerations. 
The provisions of CLAW expressly provide for a high level of protection for women of 
reproductive capacity, as the foetus is now known to be at greater risk from exposure to 
lead than adults. Nevertheless, public consultation on CLAW when still in draft form 
confirmed that there were continuing societal concerns over the employment of youngsters 
in such work activities, and the Regulations expressly ban the employment of young 
persons, as well as women of reproductive capacity, in a list of specified activities 
involving work in lead smelting and refining, and in lead-acid battery manufacture. 





136 We must stress that we use the above criteria and framework flexibly and with 
commonsense. As we have pointed out, because of the iterative nature of the decision-making 
process as we go through its stages, we often gather information from one stage which is 
relevant to other stages and that, for example, going through the decision-making stages may 


suggest new options that should then be considered. 
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ANNEX 1 


SOME OF THE CONVENTIONS ADOPTED FOR UNDERTAKING RISK 
ASSESSMENTS 


Actual and hypothetical persons 

1. Though a risk assessment can be done (and is sometimes done) to assess the risk to an 
actual person - ie the risk to an individual taking full account of the nature, extent and 
circumstances in which the exposure arises - there are three problems which limit the usefulness 
of such an approach for managing risks generally. First, as already mentioned in para 40, the 
courts have ruled that we cannot wait for people to be actually exposed to the risks before 
taking decisions about whether the risk should be incurred at all or the degree to which it should 
be controlled. Secondly, the approach could be very resource intensive. Exposure to most 
hazards is seldom confined to one person. It would be necessary to carry out a risk assessment 
for each person exposed since individuals are affected by risk differently depending, amongst 
other things, on their physical make up, abilities, age, and the circumstances giving rise to their 
exposure. Thirdly, it would be very difficult to extract and distil useful information from all the 


individual assessments. 


2. In practice therefore, assessment of the risks to an actual person has rather limited uses 
such as checking whether a generic measure introduced is suitable for a particular person. What 
is done instead is to perform the assessment in relation to an hypothetical person. An 
hypothetical person is an hypothetical type of individual who is in some fixed relation to the 
hazard, eg the person most exposed to it, or a person living at some fixed point or with some 
assumed pattern of life. For example, occupational exposure to chemicals is often controlled by 
considering the exposure of an hypothetical person who is in good health and works exactly 


forty hours a week. 


3. Relating assessments to an hypothetical person has several advantages. Persons actually 
exposed to the risks can compare their own circumstances to those associated with the 
measures deemed necessary to control the risks found for the hypothetical person, and decide 
whether they or their family incur a greater or lesser risk and therefore whether the measures in 
place are adequate in their circumstances. Furthermore, those who have a duty to assess risk 
and introduce appropriate measures can also reach similar conclusions in respect of those they 


have to protect. 
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Standards 

4. The results of assessments done in relation to hypothetical persons are also used for the 
adoption of standards. Standards can be regarded as generic control measures that must be 
applied to eliminate or reduce the risks for a particular hazard. The scope of the standard is set 
by specifying the circumstances in which the hazards could give rise to the risk. One feature of 
using standards is that once adopted they may be regarded as applying to the hazard rather than 


to the risk in the sense that they are applied to control risks however short the actual exposure. 


Hypothetical persons in the assessment of risk from nuclear plants 


The procedures for assessing risks from nuclear plants illustrate how careful use of the 
concept of "hypothetical persons" can reduce uncertainty and increase confidence in the 
outcome of the assessment. 


When establishing the radiation risk to those outside a nuclear site three different 
hypothetical persons are used to ensure that the control measures built into the plant and 
incorporated in its operational procedures cater both for normal operation and for all 
reasonably foreseeable faults and accidents. To ensure that any calculations do not 
underestimate the risk, these hypothetical persons are assumed to have lifestyles that would 
result in the highest realistically conceivable doses from exposure to: 


a) direct radiation from normal operation of the plant itself; 
b) routine emissions to air, water, etc.; 
c) direct and indirect radiation in the event of a fault or accident. 


The definition of each hypothetical person would have to be justified in the light of the 
nature and environment of the plant. For a) to c) above, respective examples might be: a 
child present continuously in the nearest dwelling to the site or at the point of greatest dose 
if further away; someone whose diet includes regular consumption of the greatest plausible 
quantity of a locally produced food likely to be most affected by the maximum allowable 
discharges from the plant (see note); and someone who remains at the position of highest 
dose for the duration of a release of radioactive material occurring in weather conditions 
that resulted in the greatest exposure. 


Further information: Health and Safety Executive "Safety Assessment Principles for Nuclear Plants", 
ISBN 0-11-882043-5. 


Note: In England discharges to the environment are regulated by the Environment Agency; food 
safety is currently the responsibility of the Ministry of Agriculture, Fisheries and Food. Broadly 
parallel arrangements for Scotland and Wales are expected to be little changed on implementation of 
the Government's devolution proposals. 





Procedures for handling uncertainty 

5. The procedures adopted for handling uncertainty are illustrated in Figure 2. The vertical 
axis represents increasing uncertainty in the likelihood that the harmful consequences of a 
particular event will be realised, while the horizontal axis represents increasing uncertainty in the 


consequences attached to the particular event. 
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Figure 2 
Procedures for tackling uncertainty when assessing risks 


6. At the upper left hand corner, a risk assessment can be undertaken with assumptions whose 
robustness can be tested by a variety of methods. However, as one moves along the axes 
increasingly assumptions are made that are precautionary in nature and which cannot be tested. 


7. For example, at the bottom of the vertical axis where there is a high degree of uncertainty 
about likelihoods, it is assumed that the event will be realised by focusing solely on the 
consequences, while on the far right of the horizontal axis, where there is a high degree of 
uncertainty surrounding the consequences, putative consequences are deliberately assigned to 
the hazard. 


8. It is also worth noting that though more information frequently leads to a decrease in 
uncertainty, it does not change the probability of an event. For example, though frequent 
inspections of a critical component may reduce the uncertainty regarding the probability of the 
component failing within a period of time, the inspections do not reduce the probability of the 


component failing. This is illustrated by the puzzle” in Figure 3. 


a7 





Puzzles from Martin Gardner, reproduced from Scientific American, August 1998, p49. 
7 
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Figure 3. Puzzle illustrating the relationship between probability, information and uncertainty. 





You are at a game show. The quiz-master places three cards face down on a table. One of the 
cards is an ace, the other two are face cards. You are asked to place a finger on one of the 
cards, betting that the card is the ace. The probability that you have picked the ace is clearly 
Ys. The quiz-master secretly peeks at the cards. Since there is only one ace among the three 
cards, at least one of the cards you didn't chose must be a face card. The quiz-master turns 
over this card and shows it to you. 


Question: What is the probability that your finger is now on the ace? 
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Answer: Most people believe that the probability has risen from % to %. After all only two 
cards are face down, and one must be the ace. Actually the probability remains %. The 
probability that you did not pick the ace remains % but the quiz-master has removed some of 
the uncertainty by showing that one of the two unpicked cards is not the ace. So there is a % 
probability that the other unpicked card is the ace. If the quiz-master gives you the option to 
change your bet, you should without hesitation shift your finger to that card. 





When assessing risks the situation is of course even more complicated. Unlike the above 
example, we do not know all possible outcomes that may arise from a hazard nor their 
distributions. 
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ANNEX 2 


IDENTIFYING AND CONSIDERING OPTIONS FOR NEW REGULATIONS, 
APPROVED CODES OF PRACTICE AND GUIDANCE 


1. When considering a specific risk problem, HSC/E are often confronted with the question 
as to how they should use the powers conferred on them by the HSW Acct, to clarify how duty 
holders should comply with their legal duties under the Act. In these circumstances, in our role 
in advising the HSC, we need to decide whether the new measure is really necessary and, if it is, 
what form this should take so that the decisions reached take due account of the framework in 
Part II of this document, the architecture of our health and safety law, and the fact that there 


may be constraints in pursuing certain options. How we tackle this question is explored below. 


Architecture of health and safety law 

2. The HSW Act puts a range of regulatory instruments at HSC's disposal in its role as 
guardian of occupational health, safety and welfare. These include making proposals to the 
Secretary of State for new legislation, and issuing Approved Codes of Practice (ACoPs) and 
guidance. The Act also makes provision for modernising health and safety law according to a 
particular architecture. Regulations, like the Act itself, should, so far as possible, express 
general duties, principles and goals with subordinate detail set out in ACoPs and guidance. As 
such the architecture is designed to keep the need for interventions by the regulator to a 
minimum. 

3. The architecture takes the following form: 


# the general duties on employers, self-employed persons and others in the HSW 
Act. They amount to a statutory (criminal law) enactment of common law duties 
of care. They are comprehensive in coverage - of people, places, activities and 
other sources of hazard. All are qualified by "so far as is reasonably practicable" 


(SFAIRP); 


. ™ regulations, which clarify particular aspects of the general duties and are 
mandatory. They do not add to the scope of the general duties, but regulations 


may impose a higher standard of duty (‘practicable' or absolute requirements); 


Of special mention is the Management of Health and Safety at Work Regulations 
1992 (MHSWR). These require employers and self-employed people to assess 


the risks in their undertakings so as to identify the measures they need to have in 
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place to comply with their duties under health and safety law. As such, the 
assessment provisions of MHSWR are superimposed over all other workplace 


health and safety legislation including the general duties in the HSW Act; 


ACoPs, which clarify particular aspects of the general duties and regulations, and 
are HSC's way of spelling out their implications. ACoPs have a special guidance 
status in that they reverse the burden of proof in legal proceedings. Accordingly, 
the HSC agreed in 1996, following consultation, that it would limit the use of 
guidance having the status of an ACoP to cases where four conditions were met. 


These are: 


¢ when there is clear evidence of a significant or widespread problem; 

¢ when the overall approach being taken to an area of risk is by amplifying 
general duties in the HSW Act or preparing goal-setting regulations (see 
below); 

¢ when there is a strong presumption in favour of a particular method or 
particular methods that can be amplified in an ACoP in support of the general 
duties or goal setting regulations to give authoritative practical guidance; 

¢ when the alternative is likely to be more prescriptive regulation; 

guidance, which is not law but gives advice on measures available and what is 


good practice. 


4. Regulations broadly take three forms: 


"process' regulations concerned with what has to be done to manage the control 
of risks. These include requirements to assess risks, set out management 
approaches, draw up safety cases, notify hazards, keep records etc. Many of the 
requirements are derived directly from what is implicit in the general duties, eg 
the need to assess risks. They deal with matters where there is a need to 


demonstrate that risk is subject to careful, explicit control; 


goal-setting regulations which say what are the objectives to be achieved but 
leave considerable freedom on how these objectives are to be met. Goals or 
targets to be met in such regulations are often qualified by ‘reasonable 
practicability’ and thus demand from both regulator and duty holders some 


matching of response to risk and of cost to benefit; 
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« standard-setting regulations which prescribe what constitutes an appropriate 


_response to a hazard. 


5. These forms are not mutually exclusive, ie a set of regulations could contain all three. 


Constraints 


6. The regulation of occupational health and safety risks is subject to certain constraints, 


some voluntary and others which we must take into account. In the latter category we would 


include: 


the fact that most health and safety legislation these days originates from the 


European Union, mainly in the form of European Commission (EC) directives. Once 
adopted, the UK has to transpose the provisions of the directive into national 
legislation. Though the framework described in Part 3 of this document will be most 
useful to inform the line that should be taken in negotiation of directives, 
compromises reached during the negotiations may result in measures for managing 
risks which do not fit completely in either the framework or the above architecture. If 
the enabling provisions of the HSW Acct (as is often the case) are subsequently used to 
implement the directives into UK law, these 'misfits' will inevitably be reflected in the 
implementing legislation - irrespective of the results of the consultation exercise which 
the procedures laid down in the Act require the HSC to undertake when proposing 


new regulations; 


the need, when modernising legislation preceding the HSW Act, to maintain or 


improve the standards of health, safety and welfare. 


7. Voluntary constraints include: 


adhering to the general principle that standards of health, safety and welfare should be 
maintained, even when this is not mandatory, for example, when replacing legislation 


or guidance introduced post the Act; 


ensuring that, wherever possible, regulatory measures adopted domestically fit as far 


as possible with the architecture described above. 


Hierarchy of options 


8. Based on our wealth of experience in applying the framework and while taking account of 


the above constraints, the following procedure has evolved for identifying options most likely to 


work for new regulatory measures and the order in which they should be considered: 
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i) reliance on the general duties and the Management of Health and Safety at Work 


Regulations. These would be judged as sufficient unless: 


past experience shows enforcement of the above duties does not succeed; 
there is a high level of uncertainty about what is required; 
EC Directives require more specific legislation to be introduced domestically; 


societal concerns require that some explicit form of action is needed (politically 


or to allay public fears). 


ii) use of guidance. This may help to deal with some of the above, but could be 


insufficient if: 


EC Directives require more; 
the need to address societal concerns requires more; 


the current compliance record suggests guidance will not be effective, or will 
leave too large a gap between average and poor compliance; 

statutory regulation is required to ensure a level playing field for the risk creators; 
the general view of stakeholders is that guidance alone leaves too much discretion 
to duty holders and/or HSW Act inspectors, eg in interpreting ‘reasonable 


practicability’ and measures necessary to reduce risk 'as low as reasonably 


practicable' (ALARP). 


iii) ACoPs. These may help to overcome some of the above, whilst still allowing scope 


for alternative, equally good, ways of controlling hazards and reducing risks. They 


would be considered particularly effective if: 


there is rapidly developing technology offering new ways of achieving good 
practice; 

there is high diversity of circumstance best dealt with by allowing different 
approaches; 

the industry is highly organised, homogeneous and capable of a fair degree of 
self-regulation; 

the ACoP can be used, in effect, to define reasonable practicability and hence 
prevent over-response by industry, over-enthusiasm by enforcers and over-selling 


by intermediaries. 
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But an ACoP is likely to be regarded as insufficient if: 


‘the hazard requires an absolute and/or prescribed duty to deal with it; 


EC Directives allow no alternative approaches; 


there is not a sufficiently strong statutory 'peg' on which to hang requirements in 
an ACoP (since ACoPs are not to be used to introduce higher duties by the back 


door); 


the need to address societal concerns requires more. 


iv) goal-setting regulations. These may help to amplify general duties in ways which 


overcome most of the above. But these may still be insufficient if: 


EC Directives require specificity or prescription; 


HSC has decided that adequate control of the risk from a particular hazard 
requires that specific standards have to be met; 

fair competition requires duty holders to do the same thing as well as to achieve 
the same results; 

uncertainty needs to be reduced to the minimum (including allowing minimum 


discretion to the regulator); 


the need to address societal concerns require more, such as the introduction of 


process regulations. 


specific or prescriptive regulations. These may be justified to: 


deal with manifest hazards and/or those hazards entailing high risks or societal 


concerns; 
deal with new hazards so as to ensure consistency of action; 


secure a step-change in behaviour in known areas of bad practice (including 
changes that will reduce the 'spread' of performance and bring bad performers up 


to generally acceptable levels); 


define and eliminate uncertainty by providing a generic assessment of risk and a 


suitable response which can help cut costs; 
secure standardisation and fair competition; 


meet the requirements of EC Directives; 
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# allay worker and public concern by transparent measures and accountability; 
= cut down duty holders and/or inspectorial discretion; 


= ban a specific activity or process in line with the criteria adopted for stage four of 


the decision making process. 


9. If specific or prescriptive legislation needs to be introduced then process regulation will be 
used as last resort. Such regulations tend to be resource intensive and could require (in 
ascending order of stringency) the notification of the hazard; the drawing up of safety cases for 
demonstrating that the risks from the hazard are adequately controlled; or establishing a 


licensing system that stipulates specific conditions for ensuring health and safety. 
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ANNEX 3 
SOME ISSUES RELEVANT TO ASSESSING RISK REDUCTION OPTIONS 


Implications of case law on ‘reasonable practicability’ 

1. As discussed in Part I of this document, health and safety legislation often imposes duties 
qualified by the concept of ‘reasonable practicability’. Because, ultimately, it is a matter for the 
courts to decide whether or not duty-holders have complied with such duties, considerable 
attention must be paid to how the courts have interpreted the concept. Case law on duties 
qualified by 'so far as is reasonably practicable' (SFAIRP) makes it clear that the courts will look 
at all relevant circumstances, on a case by case basis, when reaching decisions on the 


appropriateness of action taken by duty-holders in meeting this qualification. 


2. Of particular importance in the interpretation of SFAIRP is Edwards vs the National Coal 
Board [1949] 1 All ER 743. This case established that a computation must be made in which 
the quantum of risk is placed on one scale and the sacrifice, whether in money, time or trouble, 
involved in the measures necessary to avert the risk is placed in the other; and that, if it be 
shown that there is a gross disproportion between them, the risk being insignificant in relation to 
the sacrifice, the person upon whom the duty is laid discharges the burden of proving that 


compliance was not reasonably practicable. 


3. When assessing compliance with duties qualified by all injunctions embodying the concept 
of ‘reasonable practicability! such as SFAIRP, ALARP (as low as reasonably practicable), 
ALARA (as low as reasonably achievable), it is now taken for granted that such duties have not 
been complied with if the regime introduced to control risks fails the above ‘gross 
disproportion’ test. This is usually achieved by weighing each opportunity for an incremental 


reduction in risks against the presumed benefits in terms of the avoidance of injury. 


4. As explained in paras 128-129, normally, risk reduction action can be taken using good 
practice as a baseline - the working assumptions being that the appropriate balance between 
costs and risks was struck when the good practice was formally adopted and the good practice 
then adopted is not out of date. However, there will be cases where some form of computation 
between costs and risks will form part of the decision-making process. Typical examples 
include major investments in safety measures where good practice is not established, new 
regulations and, sometimes, in determining action following a formal risk assessment (see paras 


97-100 & 132-135). Moreover, certain hazards regulated through a safety case regime require 
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an explicit demonstration in the safety case that control measures introduced conform with the 
ALARP principle. Though this requirement can often be met by showing that the control 
measures adopted represent good practice there will, nevertheless, be certain occasions where 
there will be a need to show (not necessarily by a full cost benefit analysis) the trade-offs 


between the costs of introducing particular options and the risk reduction thereby achieved. 


Risks to be taken into account 

5. It is often possible to regard any hazard as having more remote causes which themselves 
represent the "true hazard". For example, when considering the risk of explosion from the 
storage of a flammable substance, it can be argued that it is not the storage per se which is the 
hazard but the intrinsic properties of the substance stored. Nevertheless, it makes sense to 
consider the storage as the hazard on which to base the estimation of risk since this approach 
will be the most productive one in identifying the practical control measures necessary for 
_ managing the risks, such as not storing the substance in the first place, using less of it, or a safer 


substance, or if there is no alternative to storing the substance, using better means of storing it. 


6. HSE would not normally expect to consider risks other than those which: 


= arise out of reasonably foreseeable events and behaviour. What is reasonably 
foreseeable will depend on the circumstances. For example, the risk of a well 
designed, properly built and well maintained building collapsing would not be 
considered a reasonably foreseeable event (unless signs such as subsidence, cracked 
walls or falling roof tiles suggest otherwise). This is because the risks were 
considered and taken care of by the building designers, contractors and maintenance 
engineers and the building is unlikely to collapse unless there was an external event 
such as a severe earthquake or explosion. 
On the other hand, it would be proper to consider the effects of an earthquake or 
explosion in the case of major hazard industries because they could trigger an even 


greater catastrophic event; and the risk of a building collapsing during its demolition; 


= are under the control of the duty-holder. This is in line with the regulatory framework 
provided by the HSW Act, which for example requires employers to ensure the health 
and safety of their employees and members of the public who may be affected by the 
conduct of the employers' undertakings. When determining what is reasonably 
practicable, the risks which an employer needs to consider are limited to those which 
he is in a position to eliminate or control. 
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For example, a railway operator would not need to consider whether increasing their 
fares would put more people at greater or less risk overall because they suspect that 
some people might be inclined to choose to travel by inherently less safe modes of 
transport (eg using their own motor cars). What determines such choices is very 
complex and depends on many elements. Though the operators might be able to 
control one of those elements (the price of their fares), they have no way of 
controlling the other elements. Nor for the same reasons would they in practice be 
able to reach a view on the impact of their proposed fare increases on the level of risk 
overall. On the other hand it would be quite proper for Government to consider such 


matters. 


7. Within these constraints, it is important that the risk be assessed in an integrated manner. 


This will allow the ‘full picture’ of risk to be taken into account and avoid a distorted view from 


considering risks in isolation, or in a slice of time, or location by location rather than across the 


undertaking as a whole. There will therefore be a need to take into account that: 


a particular hazard might pose a risk of immediate traumatic injury and/or long-term 


health effect; 


a particular work activity might give rise to a number of hazards which could occur at 


different stages of the activity; 


hazards might arise as a direct consequence of the work activity or incidentally to it 


(eg traffic at road works); 


the same hazard may be found in the different locations of a duty-holder's undertaking 


(eg hazards occurring on the railway system). 


Ensuring consistency when comparing costs against benefits 


8. As discussed in paras 90-96 cost benefit analysis (CBA) offers a framework for balancing 


the benefits of reducing risks against the costs incurred for a particular option for managing 


risks. It does this by expressing all relevant costs and benefits in a common currency - usually 


money. It is normally undertaken for options falling within the tolerable region in Figure 1. In 


practice, a CBA cannot be done without the adoption of certain technical conventions. Those 


used generally by Government have been published in guidance” from HM Treasury. 


3 HM Treasury, Appraisal and Evaluation in Central Government, ‘The Green Book’ (1997); HMSO, 


London. 
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9. The Treasury rules are meant to cater for a wide range of circumstances and as such are 
inevitably broad brush. We examine below in more detail (but still in general terms) the policy 
rules that we consider particularly relevant for assessing the balance between the cost and 


benefits of occupational health and safety measures. 


Valuation of benefits 

10. A suitable and sufficient assessment of cost and risk can often be done without the explicit 
valuation of the benefits, on the basis of common sense judgements while, in other situations, 
the benefits of reducing risk will need to be valued explicitly. The latter is far from easy because 
the health and safety of people and their societal concerns are not things that are bought and 
sold, and yet a monetary value has to be attributed to matters such as the prevention of death, 


personal injury, pain, grief, and suffering. 


11. Where the benefit is the prevention of death, the current convention used by HSE is a 
benchmark value of about £902,500 (1998 prices) for the value of a statistical life (VOSL”). 
This is the VOSL adopted by the Department of the Environment, Transport and the Regions 
for the appraisal of road safety measures. It may well be the case that individual's willingness to 
pay for risk reduction - measured in aggregate by the VOSL - will vary, depending on the 
particular hazardous situation. For example, there is evidence that individuals place greater 
weight on the reduction of rail risks, compared to roads. Thus, the particular hazard context 


will need to be borne in mind, whichever VOSL figure is adopted. 


12. Moreover, it is also important to note that VOSL is not the only factor in balancing costs 
against risks. Measures to reduce risks to humans may also yield significant environmental 
benefits. And a judgement always remains as to whether costs are grossly disproportionate to 


benefits (see paras 17-23 below). 


Costs to be taken into account 
13. The Edwards case law, by referring to "'sacrifice" as "money, time or trouble" suggests 
that a broad interpretation of 'cost' is appropriate. In the absence of interpretation by the Courts 


we believe that the following principles should apply: 





4 VOSL is often misunderstood to mean that a value is being placed on a life. This is not the case. It 


is simply another way of saying what people are prepared to pay to secure a certain averaged risk 
reduction. A VOSL of £902,500 corresponds to a reduction in risk of one in a hundred thousand being 
worth about £9.03 to an average individual. WVOSL therefore, is not to be confused with the value 
society, or the courts, might put on the life of a real person or the compensation appropriate to its loss. 
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the costs to be considered are those which are incurred unavoidably by duty-holders 
as a.result of instituting a health and safety measure. In other words the costs that 
should be considered are only those which are necessary and sufficient to implement 
the measures to reduce risk. Where duty-holders incur additional costs for other 
reasons, these should not be counted. So, for example, extra costs incurred by the 
duty-holders adopting 'Rolls-Royce' measures where 'standard' ones would serve just 


as well should be excluded; 


for any particular measure, it will be proper to include the cost of installation, 
operation, maintenance and the costs due to any consequent productivity losses 
resulting directly from the introduction of the measure. In general, these should be 
estimated on the basis of the value of the economic resources involved. This will 
usually be the same as the financial costs to the duty-holder, but there may be cases 


where alternative estimation procedures are necessary. 


Temporary shutdown costs should be included since these clearly constitute part of 
the duty-holders' 'sacrifice' - though in cases where shutdown is necessary to avoid 
Operating in the 'intolerable' region of the TOR diagram - as will often be the case in 
licensed industries - this clearly becomes irrelevant. The significance of these costs 
depends in practice on the particular industry concerned but since such costs include 


lost production, in some circumstances they may well swamp all other costs. 


In these circumstances, full advantage must be taken of opportunities to reduce the 
effect of shutdown costs so that they do not exert unwarranted influence on the final 
result of the CBA. For example, shutdown costs can be reduced by the timing of the 
work required to put the health and safety measures in place, eg by carrying it out 
during planned maintenance, or when demand is known to be slack so that production 
can be made up elsewhere. It may often be appropriate to separate out temporary 
shutdown costs to see how they affect the overall costs and to see to what extent such 


costs can be reduced as suggested; 


monetary gains accrued from the introduction of a health and safety measure should 
be offset against the costs. This is because measures for managing risk often have the 
effect of reducing costs. Typical examples are the reduction of losses (e.g. damage to 
property, lost production) resulting from decrease in accidents or incidence of 
ill-health, and savings made from any productivity gains resulting directly from the 


is 


introduction of the measure. However, costs should be offset only against those 
productivity savings which can actually be realised, ie unit cost reductions. The 


following should not be offset: 


¢ Potential savings/gains, which may depend upon the state of the market, such as 
the profits which would result from selling on the increased production made 


possible through improved productivity; 
¢ gains which would accrue from an improved commercial reputation; 


¢ indirect savings such as those resulting from reduced insurance premiums” or 


civil damages. 


« affordability is not a legitimate factor in the assessment of costs. This ensures that 


duty-holders are presented with a level playing field. 


Discounting of costs and benefits 

14. When preparing formal CBAs, it is customary to discount future costs and benefits to 
reflect the fact that people, on balance, prefer to have benefits now and pay for them later. 
Thus they value a benefit in the present more highly than the same benefit received some time in 
the future. Similarly, a health and safety measure paid for in the present is considered more 
costly than if it is paid for at some future date. Conventional economic theory is that such 


preferences are reflected in the rate of interest paid by borrowers or to savers for capital. 


15. For most public policy applications, a real rate of return of 6% a year is used currently to 
discount costs and benefits. This assumes that all monetary costs and benefits are expressed in 
real terms (constant prices). The value that individuals place on safety benefits tends to increase 
as living standards improve, so the future values applied to such benefits should be uprated to 
allow for the impact on well-being of expected growth in average real income. On the basis of 
past trends and Treasury guidance, HSE regards an uprating factor of 4% a year as appropriate 


on the benefits side of the comparison. 


16. However, when costs and benefits accrue far into the future, the assumptions underlying 
these discounting conventions may need to be re-examined. The discounting of benefits that are 
spread over a long time-scale, say longer than 50 years, raises questions of equity between 


different generations. Special considerations may be needed for specific cases. 





25 : : A ‘ s : i < 
In some cases, insurance companies may link reduced premiums directly with the introduction of 


health and safety measures, in which case the reduction should be used to offset costs. 
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Comparison of risk against costs 

17. The test of "gross disproportion" when weighing risks against costs implies that, at least, 
there is a need to err on the side of safety in the computation of safety costs and benefits. In 
short, case law requires that there should be a transparent bias on the side of health and safety. 
The acceptance of this bias is fundamental to conformity with the law. Moreover, the extent of 
the bias (ie. the relationship between action and risk) has to be argued in the light of all the 
circumstances applying to the case and the precautionary approach that these circumstances 
warrant (see paras 82-83). Our general approach is that as a rule, whenever possible, standards, 


should be improved or at least maintained. 


18. There will be circumstances where the introduction of new technology, or new systems of 
work, provide dutyholders with an opportunity to increase efficiency or quality at the expense 
of a small increase in risk. This issue is not new. For example, it arose in the middle ages when 
printing presses were introduced to replace quill pens. However, current regulations require 
duty holders to re-assess the risks introduced by the new technology, or new system of work, to 


ensure that the risks to health, safety and welfare are properly controlled. 


19. In such circumstances we need to distinguish between two situations: 
1) the hazard and those exposed remain the same. Typical examples are when an 
employer: 
= reduces maintenance intervals because new technology allows a more reliable 
method for detecting faults (eg replacing tapping and listening, by ultrasound as a 


method for detecting cracks in metal structures); 


# modifies a process or operating conditions etc. to increase output but with some 
reduction in safety margins thereby increasing risks (eg, raising the operating 
temperature of a process to speed up the reaction thereby reducing safety margin 


on the cooling system); and 


li) ‘new hazards are created and/or risks are transferred to other parties. For 
example, in the construction industry there is an increasing trend to replace manual 
labour on site with off-site fabrication of parts which are then assembled on site using 


cranes. 


20. As far as the latter (19(ii) above) is concerned, depending on the merits of the case, we 


could consider this a new situation which must be examined on its own merits; ie requiring a 
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fresh judgement as to whether the new proposed control regime reduces risks ALARP, using 
the procedures described in Part 3. Moreover, because the situation has changed radically, 
there would be no need to make reference to the risks associated with the control regime it 
replaced. The possibility will also arise that some of the risks are transferred to a totally 
different employer. But here again under the framework of the HSW Act, it will be for each 
employer to ensure that they are complying with the relevant statutory provisions, including the 


need to ensure that risks are reduced ALARP. 


21. However, in relation to 19(i) above, the circumstances in that situation remain 
fundamentally unchanged. The new control regime is essentially nothing more than an 
alternative control measure and it is entirely proper that a comparison be made between the risk 


associated with the new and old control measure. 


22. Comparison might show either of the following for the new measure: 
i) there is a reduction in risk (or no change). In such circumstances, the comparison 
gives no grounds for objecting to the new technology/system of work. However, 
duty-holders would still need to consider whether there are any other ‘reasonably 


practicable' measures they could take to reduce risk further; or 


li) there is an increase in risk. Prima facie, the new technology/system of work is not 
acceptable since it has not reduced risks ALARP ie at least to the level achieved by 
the old technology etc. 


23. However, such an increase in risk can conceivably arise in many different circumstances 
and though HSE will not condone increases in risks lightly there will be a need for HSE to 
retain some flexibility. The following examples are illustrative of the approach to be adopted to 


achieve this. Thus we could contemplate allowing an increase in risk provided that: 


i) we are confident that the residual level of risk after the new control regime has been 
introduced is within the 'broadly acceptable’ region or near the boundary between the 


‘proadly acceptable’ and' tolerable' regions of the TOR geometry; 
ii) the change in risk, in absolute terms, is small; and 


ili) the new measure results in substantial benefits (including economic savings) but forms 
part of a package of change which overall maintains or improves the health, safety and 


welfare regime in the undertaking. The policy adopted here would be analogous to 
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iv) 


the one adopted for section 1(2) of the HSW Act when considering the replacement 
of pre-1974 legislation with new regulations which must maintain or improve 
standards (for example though replacement of the absolute duty to guard moving 
parts of machinery by one qualified by 'practicability' in the Provision and Use of 
Work Equipment Regulations is a dilution of that particular requirement, overall the 


Regulations improve standards); or 


the new measure replaces one previously adopted because the level of uncertainty 
surrounding the hazard was such that, in line with our precautionary approach, a 
demonstrably conservative measure was necessary, in terms of control needed to 
achieve a level of safety near to or within the ‘broadly acceptable’ region. New 
knowledge and reduction in uncertainty now show that the level of safety achieved by 
the old measure was in fact verging towards the negligible level and the newer and 
less costly measure achieves a level of risk no greater and possibly less than the risk 
previously assessed for the old method. However, here again duty-holders would still 
need to consider whether there are any other ‘reasonably practicable' measures they 


could take to reduce risk further. 
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ANNEX 4 
SOME STATISTICS FOR COMPARING RISKS FROM DIFFERENT HAZARDS 


1. Comparing the size and probability of the various risks we run is not an easy task. 
Different kinds of risks have to be compared in different ways. Some kinds of risk, such as 
being killed by lightning or in a road accident or by some other violent cause, are borne by large 
numbers of people or even by all of us all the time, so it is reasonable to give the chance per 


million per annum, even though some of us would have a better chance than others. 


2. However, some kinds of risk need to be compared in a way that takes account of the 
extent to which the risk is being run. For example, to compare the risks of death from travelling 
by air, road or rail we need to express it as a proportion of the number of kilometres or the 


number of journeys travelled. 


3. Estimating the annual chance of certain major events occurring also presents difficulties. 
In Great Britain, estimates of this kind can sometimes be based on direct or historical 
experience. We know for example how many major fires occur each year and we can expect 
the same trend to continue more or less. Sometimes, however, these estimates represent no 
more than a complex set of expert judgements based on a variety of factors such as the known 
rate of failure of engineering components. Some others, such as estimating the chance of an 
aircraft crash represent a scaling down of world experience. As a result, all of them are subject 
to large margins of error particularly in translating the probability of accidents occurring in 
developing countries to more industrialised ones. Moreover, some statistics will be overstated, 
eg those that depend on engineering judgement because of the caution and pessimism that it is 
customary to build into such estimates. Others will be understated because, for many hazards, 
they compare only the chance of immediate death, ignoring that the hazards also carry with 


them a risk of injury or ill health or of delayed death. 


4. Notwithstanding these important reservations, the tables below” give some idea of how 


the different risks we run compare with each other in size and probability. 
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Extract from: Galson Sciences Ltd, Review of Risk Statistics for the HSE (1997). 
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Examples of large numbers taken from everyday life: 


2 litre bottles of water in a 3 metre-deep, 50 by 20 metre swimming pool (1,500,000). 
Grains in a 500 gram bag of sugar (1,000,000). 


Teaspoons (5 millilitres) of water in a standard bath (0.5 cubic meters) (100,000). 


Examples of low probability taken from everyday life: 


The probability that the temperature below 500 meters in Great Britain will fall below 
a certain minimum value in a certain month, based on measurements from 1875 to 
1990 (Tornado and Storm Research Organisation, 1996). For example: 


¢ On any day in September, a minimum temperature of -6 C or lower has occurred 
on a total of five occasions, in five separate years (1942, 1948, 1974, 1975, and 
1979) representing an annual probability of 1 in 23. 


The probability of a high-scoring draw at a football match. The statistics reported 
below are based on data from 10,148 matches from all English League Divisions, for 
the four seasons in the period 1990-95. 


¢ A 3-3 draw occurred 118 times, representing a probability of about 1 in 100. 


¢« A 4-4 draw occurred 11 times, representing a probability of about 1 in 1,000. 


¢ A 5-5 draw occurred only once, representing a probability of about 1 in 10,000. 


The probability of winning the National Lottery is reported by Camelot in terms of a 
single lottery ticket matching the main numbers and/or the bonus ball: 


¢ Match 6 of 6 main numbers (winning the jackpot): 


1 in 14,000,000. 


e Match 5 of 6 main numbers and the bonus ball: 


1 in 2,300,000. 
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Average annual risk of death from various causes: 


Table 1 : Annual risk of death for various United Kingdom age groups based on 
deaths in 1993 (Annual Abstract of Statistics, 1996). 


Population group Risk as annual Risk as annual experience 
experience per million 


Entire population 1 in 88 11,300 


Men aged 55-64 1 in 74 13,600 
Women aged 55-64 1 in 120 8,100 
Men aged 35-44 1 in 590 1,700 
Women aged 35-44 1 in 910 1,100 
Boys 5-14 1 in 5,000 200 
Girls 5-14 1 in 6,700 150 





Table 2 : Annual risk of death for various causes averaged over the entire population. 
Cause ofdeath ——~—sAnnualrisk —_ Basis of risk and source 
Cancer 1 in 360 England and Wales 1993 (1) 


All external causes (accidents, 1 in 3,070 England and Wales 1992 (1) 
homicides, suicides, poisoning, 
others) 


All types of accidents 1 in 4,030 England and Wales 1992 (1) 
All forms of road accident 1 in 15,700 GB 1995 (2) 


Lung cancer caused by radon in 1 in 29,000 England 1996 (3) 
dwellings 


Gas incident (fire, explosion or 1 in 1,350,000 GB 1986-95 (4) 
carbon monoxide poisoning) 


Lightning 1 in 15,000,000 England and Wales 1982-95 (5) 





(1) Annual Abstracts of Statistics (1996) 

(2) Department of Transport (1995) 

(3) National Radiological Protection Board (1996) 

(4) Health and Safety Commission (1996) 

(5) Office of Population, Census and Surveys and Office of National Statistics (1984-1995) 
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Table 3: Annual risk of death from industrial accident to employees for various 
occupational groups (Health and Safety Commission, 1996). 


Cause of death Annual risk Annual Basis of risk and 
| risk per —_— source 
million 


Work-related accidents (not 1 in 100,000 GB 1995/96+ 
including self employed) 


Work-related accident (self 1 in 62,500 GB 1995/96+ 
employed) 


All types of quarry accident (quarry 1 in 5,500 GB 1983-92* 
workers) 


Construction 1in 12,600 79 GB 1991/92 to 1995/96t 
Energy and water supply industries 1in 14,500 69 GB 1991/92 to 1995/96F 


Agriculture, hunting, forestry and 1in16,800 60 GB 1991/92 to 1995/96+ 
fishing (not sea fishing) 


Metal manufacturing industry 1in 55,000 18 GB 1995/96F 
All manufacturing industry le 7 2500), 4 GB 1991/92 to 1995/96+ 


Electrical and optical equipment 1in 150,000 7 GB 1995/96t 
manufacturing industry 


All service industries 1 in 242,000 4 GB 1995/96+ 





+ Health and Safety Commission (1996) 
* Health and Safety Executive (1993) 


Table 4 : Average annual risk of serious injury as a consequence of an activity. 


Activity associated with Annual risk Basis of risk and source 
serious injury 


Irreversible paralysis within 1 in 2,000,000 vaccinations UK 1970-91 (1) 
30 days of polio vaccination 


Fairground accidents 1 in 17,000,000 rides UK 1981-88 (2) 
Road accidents 1 in 17,000,000 kilometres driven GB 1995 (3) 
Rail travel accidents 1 in 7,630,000 passenger journeys GB 1995/96 (4) 





(1) Joce et al. (1992) 

(2) Holloway and Williams (1990) 

(3) Department of Transport (1995) 

(4) Health and Safety Executive (1996) 
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Table 5 : Average annual risk of death as a consequence of an activity. 


Activity associated Annual risk Basis of risk and source 
with death 


Pregnancy (direct or 1 in 10,200 maternities UK 1991-93 (1) 
indirect causes) 


Surgical anaesthesia 1 in 185,000 operations GB 1987 (2) 

Scuba diving 1 in 150,000 dives UK 1987-94 (3) 

Fairground rides 1 in 250,000,000 rides UK 1981-88 (4) 

Rock climbing 1 in 250,000 climbs England and Wales 1987-92 (5) 
Whitewater canoeing _1 in 2,000,000 outings England and Wales 1985-95 (6) 
Hang-gliding 1 in 80,000 flights England and Wales 1987-96 (7) 


Rail travel accidents 1 in 148,000,000 passenger GB 1995/96 (8) 
journeys 


Aircraft accidents 1 in 10,000,000 passenger UK 1986-95 (9) 
journeys 





(1) Department of Health (1996) 
(2) Lunn and Devlin (1987) 

(3) British Sub-Aqua Club (1996) 
(4) Holloway and Williams (1990) 


(5) Based on the assumption that there is a total of 45,000 climbers making an average of 20 climbs per year 
each. Office of National Statistics (1997) and British Mountaineering Council (1997) 


(6) Based on the assumption that there are 100,000 whitewater canoeists making an average of 30 outings per 
year each. Canoe Focus (1996) and British Canoe Union (1997) 


(7) Based on the assumption that there are 3,300 flyers making an average of 50 flights per year. British 
Hang-gliding and Paragliding Association (1997) 


(8) Health and Safety Executive (1996) 
(9) Civil Aviation Authority (1997) 
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